Phase 2, Protéger : de la découverte à la remédiation, sans arrachage ni remplacement

The most common reason a post-quantum program stalls is the assumption that it is a forklift. Operators picture replacing every firewall, every VPN concentrator and every field device, price it, and put it in the 2029 budget. That assumption is wrong, and it is costing Canadian organizations the two or three years they actually have.

What quantum breaks, precisely

A cryptographically relevant quantum computer breaks the public key mathematics used to agree keys and sign things: RSA, Diffie Hellman and elliptic curves. It does not meaningfully break AES, the symmetric cipher that carries the traffic once a key exists. So the exposure in a typical IPsec tunnel is not the encryption, it is the key exchange. Change how the key is agreed and delivered, and the tunnel is quantum-safe with the same hardware, the same policy and the same operations team.

Two ways to close the gap

The first is the new NIST standards: ML-KEM for key establishment (FIPS 203) and ML-DSA and SLH-DSA for signatures (FIPS 204 and 205), increasingly available in firewall operating systems as hybrid key exchange. The second is symmetric key agreement: quantum-safe keys generated and delivered to both ends of a tunnel by a platform, then used as pre-shared keys, the approach the NSA's Commercial Solutions for Classified program recognizes and RFC 8784 describes. Fabric uses both, and the inventory from Phase 1 tells us which one fits each link. Where a platform already supports hybrid post-quantum exchange, we turn it on. Where it does not, or where the far end is older equipment, a partner link or an OT device, we layer symmetric keys over it.

How Fabric delivers Protect

We supply, install and validate the quantum-safe key layer, working inside the estate you already have. NetworkSecure delivers quantum-safe symmetric keys directly into existing firewall IPsec tunnels, with the security fabric, the policy and the management console unchanged. Priority follows the roadmap from Phase 1: the tunnels carrying long confidentiality data go first, then everything else in lifecycle order. Every change is validated on the wire, so the evidence that a link is now quantum-safe is observed, not asserted.

What this means for your budget

Because the hardware stays, the cost of Protect is licensing, engineering and validation rather than capital. That is why our Discovery Program is timed the way it is: assess this fall, budget in the 2027 cycle, secured by January 2028. Waiting for the equipment refresh in 2029 leaves every long lived secret exposed to harvest now, decrypt later for the years in between.