Decoding the Quantum Threat: Konstantinos Karagiannis on “Harvest Now, Forge Later” and the Collapse of Digital Trust

Hey, everyone. Welcome back here to Tech Trunk tv. You know, we're continuing our coverage this week with the winners of the recently announced Quantum Security 25 list that we did with, uh, in conjunction with our friends at DigiCert, uh, you know, highlighting 25 thought leaders in the space of quantum and, and quantum security specifically, let me introduce you to one of the Quantum 25.

It's kinda like the, the, uh, the Mercury astronauts who had the right stuff. Constantinos Karani comes to us today from the Lower East Side in New York where they're having a blizzard, and I'm glad I'm down here in Florida. Constantinos, welcome to Text Drunk tv.

Thanks. Thanks. I like the astronaut reference.

Uh, if I wore a helmet, it wouldn't mess up my hair or anything. I love it. No, you know, so I'll tell you, you know, moved, I'm Like, you from New York.

Moved down to Florida, as I said, about 20 years ago. Took the kids when they were much younger, that they're out of the house now, but we took 'em up to Ki Point, uh, Kennedy Space Center in, in Cape Canaveral. And one of the things there is you could have lunch with an astronaut.

So we signed up for, I I was, I mean, I, I was beyond crazy there. And we had lunch with, uh, I think his name was Corey Overstreet. He was, uh, he did three shuttle missions two times.

He fixed the Hubble Space telescope. My kids were bored as hell. They ate their tuna fish or whatever, and ran out.

I sat there and picked this guy's brain. I wouldn't let him leave. I mean, talk about the right stuff.

He had a law degree, a doctor degree, a PhD in physics. He was like, he's brilliant. And, uh, just I was, I was the little kid there.

So, yeah, I think we all worshiped astronauts at one point, although if you're of a certain age. Anyway, Constantinos, tell us a little bit about your journey. You weren't an astronaut, I don't think, but Sure.

I wasn't. I did go to Cape CarVal as a kid and, and I wore an Indiana Jones hat, and, uh, it was kind of hilarious 'cause it was like Uhhuh shorts, t-shirt, and an Indiana Jones hat. So go figure.

Well, look, we've all been there. We've all been there. Kids Do silly things.

Right. Um, Uhhuh and, and, uh, yeah, so I, I started in, in Quantum. Um, I, I went to Polytech Brooklyn and I, and I was studying quantum physics there.

And, um, I knew that the machines were very far away still. I knew it, you know. Um, so I kind of did it.

And I also knew I'd be doing something else too, kind of while I'm waiting for all these worlds to merge. So I spent lots of years after that. Um, working in just cybersecurity in general.

Um, I, I ended up, uh, at British Telecom, uh, BT America's division. And, and I was where, and I was the CTO of emerging threats eventually. Uh, so I was, I was involved in everything that was coming.

I was like one of the first to hack blockchain and talk about it. Um, and also I was involved in Quantum from the beginning and mostly the threat back then. That's all anyone cared about.

It was like the threat Yeah. The threat to cryptography. So I took cryptography.

Eventually I got into the use cases of things for using 'em to do other things, but the, the cryptography threat was always my baby. Um, I was, I was doing keynotes and things on the subject in 2012, if you can believe that. That's like, wow.

Crazy. Right? That's, it's so long ago that I've been warning people and now they're coming outta the woodwork to say, oh, yeah, you, you told us about this.

Yeah. Um, so it, it's been a long journey like that. And, uh, I ended up here at Privity almost, uh, seven years ago, and I was given the opportunity to build my own quantum practice from the ground up here.

Um, so I was very excited to do that and take that on. And, uh, yeah. So we ended up creating that here.

And I also got to start the Post Quantum World Podcast here. Uh, so I get to talk to the world about that for five years now. Um, so it's been, it is been fun to, to make people aware and also help them on this very important journey.

So yeah, that's kind of how I got here. I love it. You know, so, uh, when you were a BT with another Brooklyn boy, Bruce Schneider.

Yeah. Were you there when Bruce was there? Yeah, Yeah, yeah.

We, we acquired at the time, counterpa and, um, came with Bruce and yeah, so we were doing things together and all that, and I was like, oh, I kind of wanna be a little more like him when I grow up. Uh, you know. Yeah.

Well, no, Bruce is not okay for a kid from Brooklyn, right? No, he's in Minnesota. It's funny.

I am following some of his footsteps, I guess. Like I, um, I, right now I'm writing a book for Wiley on post quantum quantum photography that's gonna come out, uh, hopefully next year. And, uh, yeah.

So in some ways, I guess we ended up paralleling along the way. Um, yeah. I love it.

Smart guy. Good stuff. Um, so you went to Brooklyn Polytech and actually studied Quantum?

Yep, yep. Worked on that there, computing that. And, um, also always loved the hacking thing too, so I was like, kind of involved in both, always, you know?

I love that. What a great story, you know, for me. So I've been in cybersecurity, uh, 25, 30 years now.

Well, I, I co-founded some venture backed companies, you know, that dealt in, we didn't call it cyber, we called it InfoSec, but anyway, and then got into this media thing about 12 years ago because I started writing and speaking much like you started with your podcast, and it could be the start of a whole new career for you. Um, but, you know, the thing about quantum constantinos was, to me it was always like nuclear fusion, right? Or, or bases on the moon in Mars, right.

To go back to our astronaut stuff. It was out there, it was sci-fi, it was sci-fi. I loved sci-fi, I loved Asimov's Robots.

I love Dune and Herbert's Dune, and the, you know, all that that entails. And the, the thinking machines, the war against the thinking machines and, uh, David Brin's uplift and, and, and all the great, you know, blade Runner. The movie was really based on the Philip Dick.

I never, I'll be honest with you, I never thought I'd live to see my sci-fi kind of fantasies Become real. Yeah. Especially on the AI side, right?

I mean, just look at the movie her, that was 2013. Yeah. And it takes place in 2025.

And Wow. Did they nail it? I mean, it's crazy.

We passed it pretty much, yeah. Most Of it. I mean, but you think about Asimov writing the law, the robotic novels in the forties and fifties.

Yep. You know, and now you've got the Anthropic, uh, Claude Constitution, which is, is not anywhere, couldn't shine a light to Asimov's simplicity in the laws of robotics. And, and I do believe that AI married to robotics in the next two, three years is going to just explode, you know, on us.

Yeah. Not to get too, in terms of topic, but I mean, the idea of embodying AI might be what we need to get 'em closer seeming like conscious beings. I mean, I gotta believe we evolve consciousness If that's what we want's.

That's what I believe. We evolve consciousness for a reason to. 'cause it helps our survival as physical beings moving around in, in 3D space.

And, um, I think that might be that missing link. It's possible. Um, We'll see.

Yeah. I don't think, But we're living, we're living this dream. Yes.

And, and look, fusion is becoming closer, though. I closer, you know, I don't know when, but Quantum is really close now, right? Quantum?

Yes, it is. It is. And it's, it's real.

It's, it's accelerating more than even. I I was always a quantum optimist for obvious reasons. Mm-hmm.

Um, it's accelerating even more than I could have believed. And, uh, last June, when Craig Gigney wrote his paper, um, taking down the number of physical qubits needed to crack RSA from about 20 million all the way down to 897,000, I was like, whoa. Now we, we barely have any time left at all.

And just a month ago, uh, iceberg Quantum wrote a paper called the Pinnacle Architecture that took it down another order of magnitude. I mean, right now they're saying around a hundred thousand physical qubits to crack RSA, there's no way we're not gonna have that this decade. We're gonna have that.

Oh, no. Before 2030 QA is super imminent. It's right around the corner.

Yeah. I mean, IBM has said, what is it, 28 or 29 or bust, right. I mean, they're, they're, You've gotta migrate.

It's, it's so critical. I mean, that's why I do it at productivity. I, um, my company, uh, my practice as I'm in company is basically two major things.

Like I, I help companies with use cases. They want to do things like optimization, simulation, machine learning, using quantum computers. That's great.

And the other half of my time is spent, um, really pushing companies towards migration to p qc, post quantum cryptography. 'cause we are so out of time and it's just, everyone's been dragging their heels. Um, I, I have some theories on why they might've been dragging their heels, but, uh, we, we can't do that anymore.

No. Well, you know, we talked about human nature. I think it's human nature a little bit to drag our heels too.

And, and, you know, until, until the gun is at your head. Right. How many people did Y 2K projects starting in September of 1999?

Right? You go, well, no, no rush. No rush.

Ah, it's, it's, it started around Thanksgiving. Um, but, you know, there, there, there is that, but it is real. But, you know, Constantino's, you've lived a dual life.

Be beyond the quantum, you've been in the cyber world. Mm-hmm. When did we ever get out ahead of anything in cyber, in security?

That's a great point. See, Q day is the first time in InfoSec history that we know a zero day is coming. We've never had this luxury before.

Yeah. Heart bleed caught us all by surprise. You know, so this is more like if Y 2K and Heart bleed had a baby, I like to say that because we know it's coming like Y 2K and it affects everyone like Y 2K and it has that devastating cryptographic impact like harp bleed did.

And, um, I don't understand why everyone isn't, you know, realizing that this needs to be done yesterday. Uh, 'cause you could look at it two ways. You, you could view it as, um, oh, what if the quantum timeline slips?

What if it takes a little longer? Okay, let's say that happens. Let's say it takes a little longer.

So what, it takes time to migrate cryptographically. And because the standards are in place and deprecation process is gonna begin, you really don't have a choice whether you believe in quantum computer or not. Whether you think it's a fairytale, eventually you're gonna get in trouble.

If you're running non PQC, you know, you're gonna get dinged in audits and pen tests and, and you name it. Regulatory bodies are gonna come after you. So, so whether you believe in quantum computers or not doesn't even matter.

You're gonna have to migrate, I promise you, you will not be using RSA in 2035. You just won't be. No, I, I Don't think you're not allowed.

You can be using It in 2031, quite frankly. I hope you're right. Yeah.

So I'm just saying, uh, regulatory, uh, bodies say that we won't be using a bunch of 35, so at least there's not. Yeah. But but, but here's the good news though.

They've made it relatively painless Yes. Relatively to, to, you know, deploy like post quantum algorithms and so forth mm-hmm. So that you're not left, you know, fighting the last war with against the next war's weapons, right?

Yeah. 5 that contains pqc. Mm-hmm.

You know, you just use that, um, open SSH latest version, p qc, a bunch of tools in the industry already, p qc, um, and even for consumers, you know, like iMessage has its own custom version of it. Yeah. Um, signal, you know, on and on and on.

Uh, you can get p QC in different pieces, but you can also view it as like a quantum technical debt issue. Um, if you are a brand new company in three years from now, I almost envy you. 'cause you're gonna walk into a turnkey p QC world, you know, like the cloud R-V-P-Q-C, you're gonna buy servers, they'll be, you're gonna code, it'll be all fine.

Other companies are gonna have to do this migration. So they're gonna need a little handholding, which is kind of what we do. And, um, with that process comes the realization that quantum technical debt might just have to go away.

You know, you could think, if I want to be ready by 2030, uh, will this server even be running by 2030? Will this router be running by 2030? There's some stuff you could just sort of plan to phase out and replace.

So that's gonna take care of itself. And other things that are, That's CapEx, right? Yeah.

Yeah. And you know how people love spending money. Yeah.

Um, let's talk a little bit about your activities of productivity. Sure. Who I, it's the IT team coming to you?

Or is it the CISOs? Yeah, It's a lot of CISOs. And I have a theory about why this, we're in this mess in terms of not migrating.

Um, uh, the average CISOs, this isn't my data, but the average CISOs lifespan at a company is 18. 18 to 26 months. Yeah.

So let's say two years. So if you're only gonna be at a company two years, when you hear quantum, you think that's 10 years. I don't have to worry about it.

Lemme do all this other stuff. That's The next guy. That's the two guys from now.

Yes, Exactly. So I'm trying to impress upon them that No, no. Now it really is you, you're the guy or gal who's responsible right now for this thing that's imminent.

So there's that. So we do do a lot of CISOs and, and my company tries to simplify what we do for customers. 5.

In fact, if you go back, it used to be the big five, and Arthur Anderson was the fifth. And productivity rose from the ashes of Arthur Anderson, actually. So I Call Oh really?

I didn't know that. Yeah. Yeah.

5. Uh, so we do basically everything you can imagine, but to simplify it, we do transform, protect, respond. That's kind of like our new mantra.

And, uh, quantum touches two of those heavily, you know, like transform, I'm all about helping companies transform, uh, what they do through using quantum computers. That's great. On the protect side.

Yes. I really want to protect you. Please let me help you like you need to be migraine and pqc, let me protect you from this future ominous cliff that you're racing towards otherwise.

And what I don't wanna have to do is the respond piece in that trilogy, right. Because No one, no one wants To, no one wants to be the first to be known for a pqc fail, um, for being hack on clean Up in aisle seven. Yeah, Exactly.

You don't want be the company, the, the one bank that ever Oh, no. It's because of Quantum that we're owned, you know? Yeah.

You don't want that. So, so I'm Hoping to help companies. Did they, some preventions worth a pound of cure, whatever, Right?

Yeah. Yeah. So while we respond to all sorts of incidents, I really want to help the quantum focused customers to not have to.

I I get it. I get it. Yeah.

Let me, let me ask another, just because you're an expert, I'm interested, you know, you hear people talk about the ticking time bomb of, uh, hacked, hashed payloads. Sure. Right.

That, you know, the bad guys have stolen mm-hmm. Encrypted data just waiting for when Q day comes and they could get at it. Now, I've always had the, just like the CISO who doesn't worry 10 years from now data, especially when we're talking about personal data that, you know, is valuable, it's like, has a radioactive half-life, right?

And every, so whatever period of time, it, you know, half of it is crap. And then, you know, it continuing down. So at some point, the longer the Q day is pushed out, the more radioactive decay we get from those hashed payloads.

Yeah. But are they, are they worth, you know, for those bad guys out there, should they just throw 'em away now? Or are they worth holding onto?

Well, yeah, you had mosco on, I believe, right? On this. Yes.

And, um, Mosca, and he's a legend for Moscow Theorem. And the idea is that you have the shelf life of a secret. How long you need to keep it.

You have the amount of time it takes a company to migrate to post quantum cryptography. Those years that combined, you have to consider will a quantum computer be available before that? And if so, secrets will leak.

So some information has a really long shelf life. I mean, PII, uh, in healthcare, for example, healthcare's life lifespan is a lifespan stick with you for your life. Yeah.

So it's a really long time. So some of those secrets are good forever, right? Uh, some state secrets are good for a really long time.

Locations of secret bases, whatever, you know, that kind of stuff is a really long lifespan. Credit card numbers, no certain accounts change. You know, things like that are a little shorter.

So yes, you're right. We have to decide like, when can we actually use these attacks. Um, there's a few basic principles here.

One, when something's broken, it's broken. I, I remind everyone about that in cryptography. Whenever we know something doesn't work, we deprecate it and we move on.

3 hopefully, right? Um, you know, once we know something's no good, we move on, right? Um, it doesn't mean that the tax role is practical or gonna get everybody, but do you really wanna be the one that they get?

You know, like if, if you're writing a message that's so secret and valuable, do you really want to trust that? Um, it'll never be curious and someone will never be curious enough to attack it. So I keep that in front of my mind.

Now, realistically, most harvested packets will not be decrypted by a quantum computer. I know it's a weird thing for me to be saying Mr. Rah rah, pqc, right?

Um, but, but it's a numbers game. You know? Uh, let's say that roughly the kidney lifecycle of an attack is what we're gonna deal with.

Let's say it's five days running a quantum computer to crack RSA, that's 73 attacks a year. So if you're some, if you're China and you have a quantum computer that can attack this and you can run it for five days, you're gonna get 73 tries a year to reverse information. What are you gonna go after?

You're gonna go after some stream that the, you know, NSA used once so, or two governments used to communicate, you're gonna go after a few juicy packets like that, but they might also be nothing. And then you gotta start again. So you're only gonna get something through tries.

So I don't know if harvest not decrypt later is the number one attack that's gonna happen. Again, I'm not saying you shouldn't migrate to Pqc for data. 'cause once something's broken, it's broken.

So I believe in that a hundred percent, but I think the thing that everyone's ignoring is harvest now forged later. And that is way more devastating. Uh, lemme give an example.

Why would I attack a communication stream from a government agency when I could find out what laptop that agency is using, find out what audio driver that laptop uses, get this signing key to push an update to that audio driver, crack that in five days with a quantum computer, and now I am asis or HP or Lenovo or wherever, and now I live on every single laptop in that government agency. That is a better use of five days because now can read every message I want and see every webcam I want, or whatever you want to do. So that's the attack that literally no one's talking about.

Um, I'm gonna be talking about this in my book. I'm gonna talk about this at some spring conferences and things. Um, we need to realize that everything needs to be wide graded, uh, and firmware, uh, code signing, all those types of things need to be protected as soon as possible.

So, you know, I'd rather see that protected first and then messages, honestly. But, you know, we should do both, obviously. But, but I just think I hear that that could cause mass chaos, mass devastation.

These aren't theoretical attacks. We've already had code signing attacks. It's just that we would be using a quantum computer to inject the malware.

Not, um, you know, just traditional methods. Constantinos another and a urban myth legend. We won't know Q Day was here until much after the fact, until much later.

Right? It's possible it's not gonna be a, you know, emergency alert broadcast system mm-hmm. Letting us know that, hey, we, it's Q day, you know, you won't get a Hallmark card, but it, it may be months or even a year later that we look back and say, yes, that that threshold has passed.

You believe that? Or what do you think? I've been saying that actually since around 2012.

Um, yeah, I've been saying that since the beginning. I, when I was a bt, um, historically it was the GPO, the general post office and an employee there. Tommy Flowers built the first supercomputer designed to crack encryption.

So in my brain was always this like specter and, and legacy of the imitation game, Alan touring Tommy Flowers, like all this like crack encryption and keeping quiet about it. You know, like we let, uh, not we, but the allies let, like submarines sink because they didn't want to let anyone know we can crack enigma. So I've been saying that for a long time now, and, and it is possible that if some nation state gets a quantum computer, they're gonna stay quiet and not say that they have it, and they'll just start cracking some of the packets, like we mentioned, or doing some of the code signing attacks.

We, we mentioned. Uh, so I do believe that's possible. Um, if a company gets to that level, all sorts of things could go wrong.

If, even if they wanted to keep it secret. You know, like, let's say for example, ion Q announces an even more aggressive timeline, even though they already have the most aggressive timeline in the industry, let's say announce an even more aggress timeline. And at the very same time, unbeknownst to them, the guys who did the Pinnacle paper announced that they just reduced it by 10 x again.

So all of a sudden you have this like crossing point, like inflection point where publicly in the world we know, oh, ion Q has X number of cubits, and they just said, you only need half as many to crack encryption, whatever. Like that can happen. And then we'll know, then it won't be like announced.

It's just we'll be able to do the, connect the dots and say, oh yeah, two days is here and then, and don't believe otherwise it's here. You know? Absolutely.

So, absolutely. So that can happen to you. So those two extremes can occur.

Uh, and like anything else, the truth will probably be somewhere in the middle. Um, Love it. Yeah.

Constantino. So I gotta jump onto another, uh, uh, uh, what do you call it? Interview here.

Mm-hmm. But you mentioned your podcast. Say it again and how can people get it?

Sure. It's, uh, it's the post quantum world. Uh, it's actually the longest continuously running quantum podcast in the world.

Very cool. Yeah. So it's available on all platforms.

Excellent. And of course, I mentioned you're senior director of Quantum Computing services at Protiviti, so people can go to Protiviti and keep up with you there. Congratulations on making the list, obviously it was well deserved.

Thank you. Thank you. And keep up the great work, man.

It, you know what, a lot of years of hard work, uh, we're getting right there. So it's gonna be interesting, interesting these next couple years. Thank you.

Thank you. Constantinos. Caris, uh, senior Director Quantum Computing Services at Productivity Security Quantum Security, 25 inaugural member.

Thanks for joining us. This Tech Drunk tv. We'll be right back.