Henry Quentir 10/31/26 Henry Quentir 10/31/26

Kaspersky's Operation FlashHole Report, 21 October 2026: Lazarus Wraps LPEClient Payload Delivery in Four ML-KEM-1024 Key Exchanges Against South Korean Firms, TRL 9

Kaspersky's Securelist report of 21 October 2026 on Operation FlashHole shows the Lazarus Group's LPEClient tool receiving four ML-KEM-1024 public keys, deriving four shared secrets and decrypting its next payload with a 128-byte Threefish key, in a campaign against at least three South Korean software, construction and telecom-equipment firms since July 2025; the company's press release traces the group's use of the mechanism to September 2024. This post reads the development as an offensive post-quantum cryptography capability on the harvest-now-decrypt-later branch: what an intrusion unit gains when captured command-and-control traffic stays closed to future decryption, how the same four-key construction appeared in Check Point's August 2026 Dream Job report, and what the ML-KEM-1024 malware finding leaves unproven for a program office, at TRL 9.

Henry Quentir 10/27/26 Henry Quentir 10/27/26

IDEMIA and KT Put NIST and KpqC Post-Quantum Algorithms on One SIM for South Korea's Defense Pilot, 26 October 2026: What a Secure-Element Root of Trust Changes for Tactical Endpoints

IDEMIA Secure Transactions said on 26 October 2026 that it is implementing both the NIST algorithms and South Korea's KpqC algorithms on a quantum-resistant SIM for KT's post-quantum pilot for the Ministry of National Defense and the Army Information and Communication School, covering drones and ground control stations, CCTV and video storage, user PCs and 5G segments. This post reads the announcement as a defensive post-quantum cryptography capability: what a secure-element hardware root of trust would let a force do with tactical endpoints it already owns, why two algorithm families on one chip is the point, and what validation, conformance and performance evidence still separates a vendor release from a program office.

Henry Quentir 10/25/26 Henry Quentir 10/25/26

South Korea's Science Ministry Expands the Open Quantum Testbed Into a Nationwide QKD Network by 2028, 21 October 2026: KT and SK Broadband, Overseas Hubs in Singapore, Poland and Bulgaria

South Korea's Ministry of Science and ICT opened its Open Quantum Testbed Advancement and Expansion Project on 21 October 2026: a nationwide quantum key distribution test network reaching Daegu, Gwangju, Busan and Gangwon by 2028, run by KT and SK Broadband consortia on 7.4 billion won in 2026, with overseas hubs linking Singapore, Poland and Bulgaria. The release pairs QKD on short sections with post-quantum cryptography on the long international haul, and KT adds a wireless QKD target of 15 kilometers. This post reads the program as a defensive networking capability: what it would let a Korean agency do, who gains, and which milestones a buyer should ask for before 2028.

Henry Quentir 10/23/26 Henry Quentir 10/23/26

Georgia Tech's Gupta Puts a Ceiling on What One Twiddle Fault Leaks From ML-KEM and ML-DSA Key Generation, arXiv 2610.30383, 21 October 2026: 254 of 256 Coefficients Exposed on Paper, TRL 2

Georgia Tech's Chakshu Gupta proves, in Lean 4, how much a single corrupted twiddle constant in the number-theoretic transform exposes during ML-KEM and ML-DSA key generation: a rank that halves by layer from 128 to 2, a ceiling of 254 of 256 coefficients with one fault per layer, and two coefficients no static twiddle fault can reach. The Defense Monitor reads what the fault attack bound means for a hardware root of trust that regenerates keys from a stored seed, how it extends the 2023 electromagnetic attack on pqm4, and what a module buyer should ask next.

Henry Quentir 10/21/26 Henry Quentir 10/21/26

Quantinuum's Helios Holds a Distance-7 Color Code at Five Logical Errors per Million Rounds, 19 October 2026: What 73 Barium Ions per Logical Qubit Change in the RSA-2048 Clock, TRL 3

Quantinuum reports a trapped-ion logical qubit at five errors per million rounds on Helios with a distance-7 color code and a suppression factor of 12. The Defense Monitor reads what the result changes in the RSA-2048 resource estimate, why the clock speed stays open, and what it means for the post-quantum migration dates of 2030 and 2035.

Henry Quentir 10/18/26 Henry Quentir 10/18/26

Vietnam's Government Cipher Committee Publishes Three Draft Post-Quantum Cryptography Standards on 17 October 2026: Home-Grown HB-PQSign Beside ML-KEM and ML-DSA, on a 2027 to 2035 Roadmap

Vietnam's Government Cipher Committee, the military-ranked agency under the Ministry of National Defense, published three draft national post-quantum cryptography standards in Hanoi on 17 October 2026: a home-grown hash-based signature, HB-PQSign, beside ML-KEM and ML-DSA. Decision 125/QĐ-TTg sets standards by 2027, hybrid integration by 2030, QKD as an auxiliary technology and full transition of critical systems by 2035. What the drafts establish for a defense buyer, and the dual-stack crypto-agility question they raise for vendors.

Henry Quentir 10/9/26 Henry Quentir 10/9/26

Europol and UC3M's Harvest Now, Decrypt Later Report, 7 October 2026: Which Captured TLS, SSH and OpenPGP Traffic a Quantum Computer Could Read, and Why Government Communications Rate High Risk

Europol and Universidad Carlos III de Madrid published a 40-page assessment of harvest now, decrypt later on October 7, 2026. It rates government communications and law enforcement files HIGH risk, maps which captured TLS, SSH and OpenPGP sessions a quantum computer could open, and tells high-risk holders to enforce forward secrecy, pilot hybrid key exchange and build a national post-quantum strategy.

Henry Quentir 10/5/26 Henry Quentir 10/5/26

Airbus Quantum-Secure Tactical Communications Trial in Malta, 10 and 11 September 2026: Agnet, Telsy QKD, Stormshield Encryptors and Merqury Key Management, and What a Program Office Still Needs

On September 10 and 11, 2026 Airbus's defense and space division ran a self-funded trial in Malta in which military and law enforcement users on separate networks exchanged traffic over a hybrid post-quantum and quantum-key tactical network: Agnet at the center, Stormshield encryptors, Telsy quantum key distribution through QTI, Merqury's key management and software-defined networking, all on Melita's infrastructure. We read the October 5 statement and the Maltese quantum links that preceded it since January 2024: the orchestration layer is the new result, the quantum plumbing was already in service, and it is a defensive crypto-agility capability at rung 6. Authentication of the quantum channel, published node counts and key rates, and divided national doctrine on QKD are what a program office still needs.

Henry Quentir 10/4/26 Henry Quentir 10/4/26

Sectigo Quantum Ready, Announced September 17, 2026: What Cryptographic Discovery Must Show a Defense Buyer

Sectigo announced Quantum Ready on September 17, 2026. A defense buyer evaluating cryptographic discovery needs evidence of estate coverage and reliable dependencies before the findings can support post-quantum migration decisions.

Henry Quentir 10/2/26 Henry Quentir 10/2/26

NATO's Quantum Technology Roadmap, Published 29 September 2026: QUESTOR Sea Trials for GNSS-Denied PNT in 2026 and 2027 and a Quantum Zero Beacon Pilot Between Brussels and Mons by Q4 2027

On September 29, 2026 NATO released the public summary of its Quantum Technology Roadmap, approved by Allies on July 30, the first official text to put dates on the Alliance's quantum work. We read the fifteen paragraphs and the table of milestones: QUESTOR sea trials with STO-CMRE in 2026 and 2027 testing quantum sensing for positioning, navigation and timing where GNSS is denied, a first pilot report in Q1 2027, the Quantum Zero Beacon post-quantum cryptography pilot between NATO HQ and SHAPE by Q4 2027, an Allied Quantum Computing Access Network concept the same quarter, and a standards roadmap in Q3 2029. The document is a policy instrument with no sensor, vendor, budget or performance threshold in public, so the readiness ladder does not yet apply, and we set out which two dates will produce evidence a program office can use.

Henry Quentir 9/28/26 Henry Quentir 9/28/26

ETSI TR 104 171, Announced 24 September 2026, Sets Entropy Zero Trust and Four Trust Levels for Quantum Random Number Generators: What Its Side-Channel Catalog Means for Military Key Generation

ETSI announced on September 24, 2026 its technical report TR 104 171, published in March 2026, on building a quantum random number generator whose output stays unpredictable once real detectors, power supplies and drivers surround the quantum source. We read its Entropy Zero Trust profile, its four trust levels up to a military and critical-infrastructure grade, and its catalog of blinding, electromagnetic, radiation, power and timing side channels as defense-specific capability: who gains from an attested entropy source beneath a hardware root of trust, what a surveillance-drone one-time pad and a certificate authority ask of the same device, and why an informative report with no test method for its top trust level still leaves a program office to write its own acceptance test.

Henry Quentir 9/24/26 Henry Quentir 9/24/26

Shandong University's Chen and Li Recover 16 Private-Key-Dependent Bits From BIKE's BGF Decoder by Deep-Learning Power Analysis at 95.68 Percent, Cybersecurity 9:215, 16 September 2026

On September 16, 2026, the journal Cybersecurity published a paper by Geng Chen, Yanbin Li and colleagues at Shandong University that reads a private-key-dependent 16-bit sequence out of the BIKE post-quantum decoder from a single power trace on an ARM Cortex-M4 board, at 95.68 percent perfect recovery. We read the deep-learning side-channel attack as an offensive extraction method, weigh what it does and does not transfer to the ML-KEM and HQC code a force will field, and set out the missing key-recovery stage, the untested countermeasures and the single-board evidence that stand between this post-quantum implementation security result and anything a program office would plan against.

Henry Quentir 9/15/26 Henry Quentir 9/15/26

Malaysia Is the Only ASEAN State Rated Tier 1 for Post-Quantum Cryptography Migration Readiness in SITG-Consulting's September 2026 Assessment of the ASEAN-10

Malaysia's National Security Council says the country is the only ASEAN state at Tier 1 for post-quantum cryptography migration readiness, on the strength of SITG-Consulting's September 1 assessment of the ASEAN-10. We read what counted as evidence, why Singapore's voluntary guidance stopped at Tier 2, and what a national readiness assessment tells a defense planner about harvest now, decrypt later exposure.

Henry Quentir 9/7/26 Henry Quentir 9/7/26

Circle's August 31 Disclosure Reads 813 Logical Qubits Off Eigen Labs' ECDSA.fail Leaderboard: What a Google and Stanford Estimate Says a secp256k1 Attack Actually Costs

Circle's August 31 disclosure tells developers that breaking elliptic curve signatures now takes 813 logical qubits, a figure lifted from one axis of Eigen Labs' ECDSA.fail circuit competition. We put it back beside the March 2026 Google, Stanford, and Ethereum Foundation estimate, under 1,200 logical qubits and 90 million Toffoli gates on fewer than half a million physical qubits, and beside Willow's actual 105 physical qubits, to show how a defense buyer should read quantum cryptanalysis headlines while setting a post-quantum migration schedule.

Henry Quentir 9/6/26 Henry Quentir 9/6/26

SEALSQ's QVault TPM Puts ML-DSA and ML-KEM in Silicon and wolfSSL's wolfTPM Now Drives It: What the September 3, 2026 Integration Means for Long-Life Defense Platforms

SEALSQ and wolfSSL announced on September 3, 2026 that the wolfTPM stack now drives the QVault TPM, a chip on track to be the first shipping TPM 2.0 device with ML-DSA and ML-KEM in silicon under the Trusted Computing Group's v1.85 specification. We read the integration as a hardware root of trust story for thirty-year defense platforms, where the soldered TPM is the last chip to change, and set out what still stands between this laboratory integration and a post-quantum TPM a program office could specify: an availability date, independent validation and public side-channel scrutiny.

Henry Quentir 9/4/26 Henry Quentir 9/4/26

Cloudflare's 2029 Target, HPE's 24 to 48 Months, Dell's 1.2 Million Old Servers and QuSecure's Vendor-Reported TRL 7: Four Post-Quantum Clocks Against EO 14412's 2030 and 2031 Deadlines

Four companies put dates and numbers on the post-quantum migration in the first week of September 2026, and none of them is a government. Cloudflare's roadmap, restated in the German trade press on 4 September, targets completion in 2029; HPE told enterprises on 4 September to plan on 24 to 48 months; Dell told investors on 1 September that 1.2 million of its installed servers are old enough that customers are refreshing them, with security requirements among the reasons; and QuSecure reported on 2 September that its platform ran under soldier operation at a US Army exercise and, by the company's reading, reached Technology Readiness Level 7. Read against Executive Order 14412's 2030 and 2031 federal deadlines, the four give a program office something the policy documents do not: the pace at which suppliers say they can move, and the size of the installed base that has to be carried along.

The four announcements measure different things. Cloudflare's is a post-quantum roadmap with dated milestones, the first of which it has announced support for. HPE's is a lead-time estimate for a large enterprise. Dell's is a count of hardware that customers are replacing whatever the cryptography does. QuSecure's is a readiness level reported by the company from a field exercise. This Monitor reads each one for what it can support, then sets all four beside the federal calendar and beside what the founder of this site wrote about lead times in War on the Rocks in July.

Henry Quentir 9/4/26 Henry Quentir 9/4/26

ASD's LATICE Guidance of 20 July 2026 and the NCSC's Workshop Report of 22 July 2026 Both Start With the Cryptographic Inventory, and the EU's End-2030 Date Leaves Little Time to Build One

Three post-quantum migration documents surfaced together on 4 September 2026: the Australian Signals Directorate's LATICE guidance of 20 July, the UK NCSC's report of 22 July on its first industry migration workshop, and an Italian reading of the EU roadmap that sets the end of 2030 for critical infrastructure. ASD and the NCSC both begin with a cryptographic inventory, which ASD says should be started in partial form and maintained over time. The NCSC gives large organizations two to three years for that discovery phase against its 2028, 2031 and 2035 dates, and its workshop found that supplier readiness decides whether a plan can be kept. This Monitor reads what the documents let a program office refuse, and what an inventory cannot answer.

Henry Quentir 9/3/26 Henry Quentir 9/3/26

Forescout Finds Post-Quantum Key Exchange on More Than 19 Million of 160 Million SSH Servers, With OT at 16 Percent and Medical Devices at 6 Percent

Forescout's Vedere Labs measured post-quantum key exchange across more than 160 million internet-facing SSH hosts: support grew 72 percent in a year, to more than 19 million servers, with Forescout attributing most of the growth to OpenSSH upgrades. The same measurement puts operational technology at 16 percent, medical devices at 6 percent, and embedded Dropbear stacks at 3 percent. We read the two-speed migration as a capability question for the long-lived equipment defense estates run on, and what crypto-agility clauses should demand of 2027 contracts.

Henry Quentir 9/2/26 Henry Quentir 9/2/26

MIT and Google Cryptographers Refute Daniel Simon's Claimed Quantum Attack on the Lattice Problems Behind ML-KEM

Daniel R. Simon of AWS claimed a polynomial-time quantum algorithm for the dihedral coset problem, a result that would have reached the lattice mathematics underneath ML-KEM. Aparna Gupte, Seyoon Ragavan and Mark Zhandry answer with an impossibility proof: the algorithm, and every design like it, leaves key recovery at random guessing. We read what the three-week episode means for post-quantum cryptography migration and the program offices behind it.

Henry Quentir 8/25/26 Henry Quentir 8/25/26

A Task Force for the Ciphertext Already on Deposit

The U.S. Treasury has launched a Quantum-Readiness Task Force to move the financial sector onto post-quantum cryptography, anchored to Executive Order 14412 and its 2030 and 2031 federal deadlines. We read the announcement through the threat it exists to counter, harvest now, decrypt later collection against long-lived financial data, and list the checkpoints that would show a coordination body turning into an enforceable migration calendar.