GLOSSARY
The vocabulary of post-quantum cryptography as it applies to Canadian operators. Each entry gives a definition in two sentences and one sentence on why it matters. Terms are listed alphabetically. Last reviewed September 2026.
Bill C-8 is Canadian federal legislation that received Royal Assent in June 2026. It amends the Telecommunications Act to make security a policy objective and creates the Critical Cyber Systems Protection Act, which requires designated operators in finance, telecommunications, energy and transportation to maintain a cyber security program, manage supply chain risk, report incidents and comply with cyber security directions. Why it matters: it is the first Canadian statute that attaches a regulator and penalties to critical infrastructure cyber security, and the regulations that define the details are still being written.
The Commercial National Security Algorithm Suite 2.0 is the United States National Security Agency's list of quantum-resistant algorithms required for national security systems, with transition dates through the early 2030s. It specifies ML-KEM and ML-DSA for key establishment and signatures, LMS and XMSS for firmware signing, and AES-256 and SHA-384 or SHA-512 for symmetric use. Why it matters: Canadian defence suppliers and vendors selling into allied programs are measured against it.
Crypto agility is the ability to change the cryptographic algorithms, key sizes and protocols a system uses without redesigning or replacing the system. It depends on knowing where cryptography is used and on architectures where the algorithm is a configuration choice rather than a hard coded assumption. Why it matters: the post-quantum standards will be revised again, so an estate that can only migrate once is not migrated, it is merely updated.
A cryptographic inventory is a record of every place an organization uses cryptography: the algorithms, key lengths, protocols, certificates, libraries and the systems and data flows that depend on them. It is the first step every government migration roadmap asks for, and it is usually built by observing live traffic rather than by asking people. Why it matters: you cannot prioritise, report on or defend cryptography you have not found.
Encryption Intelligence is the cryptographic discovery and assessment service Fabric Networks delivers. Passive probes observe IT and OT traffic, build the cryptographic inventory, rank exposure by risk and produce a migration roadmap mapped to NIST and Cyber Centre guidance. Why it matters: it turns the inventory requirement in ITSM.40.001 and Bill C-8 into a deliverable with a date on it.
Harvest now, decrypt later is the practice of recording encrypted traffic today in order to decrypt it once a sufficiently capable quantum computer exists. It targets data whose value outlasts the cryptography protecting it, such as engineering designs, personal records, government communications and long lived operational secrets. Why it matters: the attack is already happening, which is why migration is urgent even though the quantum computer is not here yet.
A hybrid key exchange combines a classical algorithm (such as ECDH) with a post-quantum algorithm (such as ML-KEM) so that the session is secure if either one holds. It is the standard transition approach in TLS 1.3 and IPsec. Why it matters: many implementations silently fall back to classical only when the peer does not support the post-quantum part, which is compliant on the data sheet and exposed on the wire.
ITSM.40.001 is the Canadian Centre for Cyber Security's Roadmap for the Migration to Post-Quantum Cryptography for the Government of Canada. It required departmental migration plans by April 2026 with annual reporting, high priority systems migrated by the end of 2031 and all remaining systems by the end of 2035, and it expects quantum-vulnerable algorithms to be disabled, isolated or tunnelled rather than run alongside new ones. Why it matters: those dates become a supplier's dates the day it sells to, connects to or is regulated by the federal government.
ML-KEM (FIPS 203) is the NIST standard post-quantum key encapsulation mechanism, formerly Kyber; ML-DSA (FIPS 204) is the standard post-quantum digital signature algorithm, formerly Dilithium. Both were published as final standards in August 2024 and are the algorithms most protocols and products are adopting first. Why it matters: when a vendor says post-quantum ready, these are the names to look for on the data sheet.
NetworkSecure is the product Fabric uses to deliver quantum-safe symmetric keys into the IPsec VPN tunnels on firewalls a customer already runs, for example Fortinet FortiGate, Juniper SRX, Cisco, Palo Alto Networks and Ciena optical encryption, among others. Those are examples, not an exclusive list; the approach is vendor agnostic. The hardware, routing and policy stay in place; the key exchange underneath stops being harvestable. Why it matters: it is how an operator gets quantum-safe transport without rip and replace.
Post-quantum cryptography is the family of cryptographic algorithms designed to resist attack by both classical and quantum computers, running on ordinary hardware. It replaces RSA, Diffie-Hellman and elliptic curve algorithms, which a large enough quantum computer breaks, with lattice, hash and code based schemes. Why it matters: it is the migration every government roadmap is now scheduling.
Quantum-safe describes a system whose security does not depend on a problem a quantum computer can solve efficiently. It covers both post-quantum public key algorithms and symmetric approaches such as symmetric key agreement with AES-256. Why it matters: it is the outcome; PQC is one of the routes to it.
Symmetric key agreement is a method in which two endpoints derive an identical symmetric key from shared, continually refreshed material without transmitting the key or relying on public key cryptography. The SKA-Platform Fabric operates generates keys on demand, never stores them and never transmits them. Why it matters: it removes the key distribution problem that quantum computers attack, and it runs on the firewalls and VPNs already deployed.
Sovereign data at rest describes storage where data is encrypted on the device with per file keys wrapped in post-quantum protection and dispersed across providers so that no single party, including a foreign cloud operator, can seize or read a dataset. Why it matters: Canadian operators subject to PIPEDA and exposed to the US CLOUD Act need a storage answer as well as a transport answer.