Uploaded May 2026 | Updated September 2026, 2 weeks ago
As we move closer to "Q-Day," focus is shifting from algorithm selection to the massive task of global deployment. Session 3 of RWPQC 2026 explores the policy landscape and the technical tools required to inventory and migrate legacy systems at scale.
In this session:
-Moses Liskov (MITRE): Outlines the six phases of cryptographic migration and analyzes the impact of US Federal policies like NSM-10, CNSA 2.0, and the Quantum Computer Cybersecurity Preparedness Act.
-Nicolas Gama (SandboxAQ): Demonstrates how machine learning can enrich cryptographic inventories, reducing false positives in Docker image scans and identifying real-world risks like expired certificates.
-Basil Hess (IBM Research): Introduces the C-BOM (Cryptographic Bill of Materials) framework within the CycloneDX standard, providing a "Lego-like" model for tracking dependencies across software, hardware, and cloud services.
Key Takeaways: Learn how to build a PQC roadmap, understand the "Harvest Now, Decrypt Later" defense status, and discover open-source tooling for automated cryptographic discovery.
Chapters:
00:00 - Introduction to Session 3
00:14 - Moses Liskov (MITRE): The 6 Phases of Crypto Migration
05:17 - US Federal Policies: NSM-8, NSM-10, and M-23-02
09:12 - CNSA 2.0 Mandates & Timelines for National Security
15:05 - Global PQC Status: China, South Korea, and the EU
20:50 - The Phase-Out of Classical RSA & Elliptic Curve
27:10 - Barriers to PQC-ready PKI
29:31 - Nicolas Gama (SandboxAQ): ML-Enriched Crypto Inventory
33:02 - Defining Quantum Readiness: Encrypted vs. PQ-Safe
40:40 - The Challenge of "False Positives" in Static Scanning
49:12 - Open Cryptography Project: Scanning Docker Images
58:37 - Basil Hess (IBM Research): C-BOMs & CycloneDX
01:03:19 - Why context matters: Naming, Hybridity, and Dependencies
01:13:21 - The Cryptography Registry of Algorithms (CycloneDX 1.7)
01:15:16 - C-BOM Kit: Automated Scanning for Git & GitHub
01:21:04 - The "Bill of Behaviors" and Product Agility Planes
#sandboxaq
As we move closer to "Q-Day," focus is shifting from algorithm selection to the massive task of global deployment. Session 3 of RWPQC 2026 explores the policy landscape and the technical tools required to inventory and migrate legacy systems at scale.
In this session:
-Moses Liskov (MITRE): Outlines the six phases of cryptographic migration and analyzes the impact of US Federal policies like NSM-10, CNSA 2.0, and the Quantum Computer Cybersecurity Preparedness Act.
-Nicolas Gama (SandboxAQ): Demonstrates how machine learning can enrich cryptographic inventories, reducing false positives in Docker image scans and identifying real-world risks like expired certificates.
-Basil Hess (IBM Research): Introduces the C-BOM (Cryptographic Bill of Materials) framework within the CycloneDX standard, providing a "Lego-like" model for tracking dependencies across software, hardware, and cloud services.
Key Takeaways: Learn how to build a PQC roadmap, understand the "Harvest Now, Decrypt Later" defense status, and discover open-source tooling for automated cryptographic discovery.
Chapters:
00:00 - Introduction to Session 3
00:14 - Moses Liskov (MITRE): The 6 Phases of Crypto Migration
05:17 - US Federal Policies: NSM-8, NSM-10, and M-23-02
09:12 - CNSA 2.0 Mandates & Timelines for National Security
15:05 - Global PQC Status: China, South Korea, and the EU
20:50 - The Phase-Out of Classical RSA & Elliptic Curve
27:10 - Barriers to PQC-ready PKI
29:31 - Nicolas Gama (SandboxAQ): ML-Enriched Crypto Inventory
33:02 - Defining Quantum Readiness: Encrypted vs. PQ-Safe
40:40 - The Challenge of "False Positives" in Static Scanning
49:12 - Open Cryptography Project: Scanning Docker Images
58:37 - Basil Hess (IBM Research): C-BOMs & CycloneDX
01:03:19 - Why context matters: Naming, Hybridity, and Dependencies
01:13:21 - The Cryptography Registry of Algorithms (CycloneDX 1.7)
01:15:16 - C-BOM Kit: Automated Scanning for Git & GitHub
01:21:04 - The "Bill of Behaviors" and Product Agility Planes
#sandboxaq
