<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Oct 29, 2021, at 1:27 PM, Joshua Marpet <<a href="mailto:joshua.marpet@guardedrisk.com">joshua.marpet@guardedrisk.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex; position: static; z-index: auto;"><div style="overflow-wrap: break-word;"><br><br><div><br></div><div>>What “known good” would you roll back to in the face of QC? Manual processing of paper checks? Going to the teller window whenever you need cash? We haven’t done that in 50 years. Do you really think we could spool those >processes back up in a timely manner and scale them to the present world economy?</div></div></blockquote><div><br></div><div>No, the tape backup from last week.</div></div></div></blockquote><div><br></div><div>OK, so you get last week’s backup. Then what? How are you going to replay the interim transactions? Remember, the fraudulent transactions are mixed with and indistinguishable from legitimate transactions.</div><div><br></div><blockquote type="cite"><div dir="ltr"><div class="gmail_quote"><div>About a week. Deploying new algorithms happens on a regular basis now. It's a bit of a PITA, but really, it's not a big deal. That's to deploy PQC resistant algorithms.</div></div></div></blockquote><div><br></div><div>Really? Throughout the entire system? Including the ATM and POS network? All of the world’s browsers? All of the smart cards? Seems a tad ambitious to me.</div><br><blockquote type="cite"><div dir="ltr"><div class="gmail_quote"><div> To roll back transactions? About a week. And the breakers would get pulled in a day, not a week.</div></div></div></blockquote><div><br></div><div>Yes, the breakers would get pulled in less than a day, but probably more than an hour. During that time, millions if not billions of transactions, both legitimate and fraudulent, will have happened. I’m not optimistic that the resulting mess could be sorted out in a week. And, BTW, even just a week with no way to conduct business is more than enough to lead to civil unrest, especially if you factor in the uncertainty. Grocery shelves were stripped bare within hours when the first covid lockdowns were announced last year. Getting toilet paper restocked took months, and that was with the financial system and other major infrastructure still intact.</div><br><blockquote type="cite"><div dir="ltr"><div class="gmail_quote"><div>Ron, I'm not trying to argue with you. But I think you're really freaked out about this, and I don't think it's worth freaking out about right now.</div></div></div></blockquote><div><br></div><div>I’m not freaked out because I don’t think QC is going to scale to cryptographic relevance any time soon. But I also think that having the financial industry prepare for that eventuality sooner rather than later is prudent because if there is a technological breakthrough that makes QC practical it will almost certainly be kept secret, so by the time it becomes evident that QC is a threat it will very likely be too late. It’s one of those low-risk-but-high-consequence events that human intuition doesn’t handle very well, and personally, I’m happy that the industry is choosing to play it safe in this regard.</div><div><br></div><div>rg</div><div><br></div></div></body></html>