FABRIC HEBDO
Singapour et Hong Kong ont dit à leurs banques quand devenir à l'épreuve du quantique, les Américains et les Australiens ont publié les questions à poser à vos fournisseurs, le Budget 2026 a financé des ordinateurs quantiques à l'échelle industrielle, et le Centre pour la cybersécurité a relayé des failles exploitées dans des équipements SonicWall, Zyxel et Siemens. Plus les phases 1 et 2 de la feuille de route Fabric.
Commencez par une conversation sur votre posture cryptographique.
Ce numéro est publié en anglais. Le titre et le résumé sont en français; le texte intégral suit en anglais.
That is the week in one line. Singapore and Hong Kong told their banks when to be quantum-safe, the Americans and Australians published the questions to ask your vendors, and Ottawa's Budget 2026 put money behind industrial scale quantum computers while leaving the ITSM.40.001 and Bill C-8 deadlines exactly where they were. Meanwhile the Cyber Centre spent the week relaying exploited flaws in SonicWall firewalls, Zyxel routers and Siemens building controllers. Long lived equipment, long lived secrets.
This is the first issue of Fabric Weekly, the newsletter version of the Library at fabricnetworks.ca. Each week we read what the Canadian Centre for Cyber Security, the Government of Canada, NATO and the allied agencies published, write it up in our own words, and tell you what we would do about it on a Canadian network. No hype, no vendor comparisons, and every item links to the original source so you can check our work. You can't fix what you can't see, so the Library exists to help you see it.
Five postings made the cut. Canadian government first, then the allies, then the standards people, which is how the Library sorts itself.
Budget 2026 funds Phase 2 of the Quantum Champions Program (Department of Finance Canada, Nov 5). Chapter 5 directs up to $2.7 billion over five years, from money already announced, to sovereign frontier technologies including Phase 2 of the Canadian Quantum Champions Program, whose stated target is industrial scale quantum computers for problems that include cryptography. It also puts $12 million over four years behind the Canadian Cyber Defence Collective's Strategic Forum. Our take: Ottawa is paying for the machines that will test today's encryption, and it did not move a single migration deadline. Read ITSM.40.001 again. Source · Our take
NSA, CISA and ASD's ACSC publish the post-quantum questions to ask your vendors (Nov 4). A vendor neutral question set for procurement, renewals and ongoing supplier reviews, organized around five phases: inventory your cryptographic dependencies, assess risk, triage, implement, communicate. Our take: staple it to your next network refresh RFP, and ask the three questions that matter most. Can your firmware accept post-quantum signatures without a hardware swap? Will you give me a cryptographic bill of materials? Which dated release makes your product quantum-safe? Then check the answers against your own inventory, because observed on the wire beats asserted on a data sheet. Source · Our take
Singapore's MAS consults on quantum-safe timelines for the financial sector (Nov 6). Consultation P019-2026 proposes a circular with supervisory expectations and completion dates: migration plans by the end of 2027, critical systems quantum-safe by the end of 2030, everything by the end of 2034. Comments close November 23. Our take: OSFI has not published a date yet, but any Canadian bank or credit union with a correspondent in Asia is about to be asked for its plan anyway, and the questions will read a lot like ITSM.40.001. Source · Our take
HKMA and HKUST launch a post-quantum toolkit for banks (Nov 2). Hong Kong's banks scored 2.3 out of 10 on the regulator's first Quantum Preparedness Index in July. The toolkit is the method for getting to 10 by 2030: governance, cryptographic exposure, transition needs, progress tracking. Our take: a regulator measured its banks, published the number, and handed them the fix. Every pillar begins with an inventory. Expect the same pattern here. Source · Our take
IETF sends post-quantum cipher suites for Messaging Layer Security to the IESG (Nov 1). ML-KEM and hybrid ML-KEM plus elliptic curve suites for MLS (RFC 9420), the group messaging layer under the big consumer and enterprise messengers, submitted for publication as a Proposed Standard. Our take: the protocols are going quantum-safe underneath the apps. Your routers, firewalls and OT gateways will not inherit any of it from an RFC. Source · Our take
Nothing from NATO this week, and no new post-quantum guidance from the Cyber Centre. We say so when the week is quiet rather than padding it.
The Cyber Centre published 27 alerts and advisories this week. We only carry the ones that touch network and OT gear, because that is where the keys live. Five qualified, and three of them are being exploited right now.
The pattern is the same one we see every week. The flaw of the day is in a firewall, a router or a controller that was installed years ago, holds keys that protect everything behind it, and does not show up on anybody's cryptographic inventory. Patching closes this week's hole. Knowing what keys that box holds is what closes next week's.
Ask a network operator how many VPN tunnels they run and you will get a number. Ask which key exchange each tunnel negotiates, which certificate sits behind the SCADA historian, or which cipher the backup appliance uses at 2 a.m., and the number turns into a shrug. That shrug is what the quantum era exposes, and every item in this week's Library points at it. The NSA's vendor questions start with inventory. Hong Kong's toolkit starts with inventory. MAS wants a plan by 2027, and you cannot plan what you have not counted.
A cryptographically relevant quantum computer breaks the public key mathematics used to agree keys and sign things. It does not care how good your firewall rules are. So the question for every encrypted flow and every stored secret on your network is a plain one: what algorithm, where does the key come from, what data does it protect and for how long, and how long will the equipment on each end stay in service. That last question is the one spreadsheet inventories miss, and it is the one that sets your priority order. A controller installed this year will still be running when the machine that breaks RSA shows up.
This is why Phase 1 at Fabric is Detect and why it runs before anybody talks about a product. The Discovery Program takes three months. We place virtual probes on your network, not agents on your systems, and Encryption Intelligence watches what is actually negotiated on the wire and what is actually stored, across IT, OT and cloud, without touching production. You get a cryptographic bill of materials: every certificate, key, protocol and cipher, tied to the asset, the data and the equipment lifecycle. It is the document your auditor, your regulator and your board will ask to see first, and this week three regulators effectively said so.
If you have not started, start small. One site, one business process, inventory only that. A single pipeline control network or a single treasury system is enough to learn how the exercise runs. Then take one question to your executive team: what data crossing our network today would still hurt us if someone read it in 2032? Their answer is the scope of your program. Read the full Phase 1 article in the Library.
The most common reason a post-quantum program stalls is that someone assumed it is a forklift. Replace every firewall, every VPN concentrator, every field device. Price it. Put it in the 2029 budget. Move on. That assumption is wrong, and it costs Canadian operators the two or three years they actually have.
Here is the part that matters. A quantum computer breaks the key exchange: RSA, Diffie Hellman, elliptic curves. It does not meaningfully break AES, the symmetric cipher that carries the traffic once a key exists. So the exposure in a typical IPsec tunnel is not the encryption, it is how the two ends agreed on the key. Change how the key is agreed and delivered, and the tunnel is quantum-safe on the same hardware, the same policy and the same operations team. The hardware stays. The keys change.
There are two ways to do it, and the Phase 1 inventory tells you which fits each link. The first is the NIST standards: ML-KEM for key establishment (FIPS 203) and ML-DSA and SLH-DSA for signatures (FIPS 204 and 205), increasingly available in firewall operating systems as hybrid key exchange. Where a platform already supports it, turn it on. The second is symmetric key agreement: quantum-safe keys generated and delivered to both ends of a tunnel and used as pre-shared keys, the approach the NSA's Commercial Solutions for Classified program recognizes and RFC 8784 describes. That is the answer for the far end that is older equipment, a partner link or an OT device, which is most of a Canadian utility.
Fabric delivers Protect inside the estate you already own. NetworkSecure puts quantum-safe symmetric keys directly into existing firewall IPsec tunnels with the security fabric, the policy and the management console unchanged. Priority follows the roadmap from Phase 1: tunnels carrying long confidentiality data go first, then everything else in lifecycle order. Every change is validated on the wire, so the evidence that a link is now quantum-safe is observed, not asserted. And because the hardware stays, the cost is licensing, engineering and validation rather than capital. Assess this fall, budget in the 2027 cycle, secured by January 2028. Waiting for the 2029 refresh leaves every long lived secret open to harvest now, decrypt later in the years between. Read the full Phase 2 article in the Library.
Three things you can do this week without buying anything. Pull the vendor question list from NSA, CISA and the ACSC and attach it to the next refresh RFP that crosses your desk. Check whether a SonicWall, Zyxel, HPE VIA, Siemens Desigo or Barracuda box is on your network, patch it, and write down what keys it holds. And pick one site and one business process to inventory, because every regulator that spoke this week started there.
If you would rather have us do the counting, start your Discovery Program at fabricnetworks.ca/start, check your exposure in two minutes at fabricnetworks.ca/risk-check, or book a briefing. The full Library, with every source linked, is at fabricnetworks.ca/resources-overview.
Fabric Networks Inc., Calgary, Alberta and Sicamous, British Columbia. Designed, supplied, installed and operated. Quantum-safe from the first splice.