HPT D-DAY 2026 urges banks to start post-quantum security testing now

SpecterAI Quantum Security’s APAC chairman said Vietnamese businesses should not wait for quantum computers to break today’s encryption before preparing. He called for banks to map cryptographic assets, migrate to post-quantum methods and use independent third-party validation to prove systems are ready.

Why it matters: - Quantum computing could eventually break widely used public-key encryption, putting long-term sensitive data at risk. - Banks and other firms that protect records for 10 to 20 years need to start planning now, not after a cryptographic failure. - Independent validation is meant to reduce blind spots in post-quantum migration and catch silent fallback to older encryption.

What happened: - TS. Peter Huỳnh, Chairman for APAC at SpecterAI Quantum Security, spoke at the HPT D-DAY 2026 forum on Oct. 15 at GEM Center in Ho Chi Minh City. - Huỳnh delivered a session in the Real Security track on post-quantum information security and independent validation. - HPT organized the event under the theme R³: Real Technology, Real Operation, Real Result, with SpecterAI as a partner.

The details: - Huỳnh warned that businesses should not wait until quantum computers can break current encryption standards before acting. - He described the “harvest now, decrypt later” threat, where attackers copy encrypted data today and store it until quantum computers can break it. - He said the real risk is already underway because encrypted data can be stolen now and decrypted later. - RSA and ECC protect TLS and digital signatures, but those public-key systems are vulnerable to Shor’s algorithm. - AES-256 remains weakened in a post-quantum world but is not broken. - NIST has standardized replacement algorithms: ML-KEM under FIPS 203 for key establishment, ML-DSA under FIPS 204 for signatures, and SLH-DSA under FIPS 205 for signatures. - Huỳnh used Michele Mosca’s inequality to frame readiness: if the time data must stay secret plus the time needed to migrate systems is greater than the time until strong quantum computers arrive, the data is already at risk. - He said leaders mainly control the migration timeline, so starting earlier is the only practical way to shorten exposure. - His five-stage roadmap for quantum-ready security starts with discovery, including a full inventory of cryptographic assets in mobile banking code, ATM and POS devices, and core banking systems. - The second stage is classification, which ranks data by how long it must remain secret. - Huỳnh cited OTPs as short-lived data and contrasted them with KYC records, 30-year loan contracts and root certificates. - He also flagged biometric data as uniquely sensitive because passwords can change, but faces and fingerprints cannot. - The third stage is assessment, which should prioritize real risk over visibility. - Huỳnh said hardware security modules, or HSMs, must be upgraded first because a post-quantum rollout can stall if HSMs do not support new algorithms. - The fourth stage is migration, including hybrid cryptography such as X25519 combined with ML-KEM-768 in TLS 1.3. - He said crypto-agility should be built in so algorithms can be changed dynamically, and quantum-safe requirements should be written into procurement contracts. - The fifth stage is validation, which must prove that post-quantum algorithms run stably in production. - Huỳnh warned about “silent fallback,” where a hybrid connection quietly drops back to older cryptography if a partner does not support the new method. - In that scenario, transactions keep running and system dashboards can stay green while quantum protection disappears.

Between the lines: - The message points to a broader shift from theoretical quantum risk to operational readiness, especially in financial services. - The emphasis on third-party validation suggests that internal teams may be too close to the build to judge whether a migration is truly secure. - The roadmap also shows that post-quantum security is not just a cryptography issue; it affects procurement, infrastructure, testing and vendor management.

What's next: - Huỳnh said internal teams should handle discovery, classification, assessment and migration, while independent third parties should perform validation. - He said readiness criteria should be defined before migration begins. - He also called for continuous validation because systems, partners and patches keep changing. - The final takeaway from his remarks is that the organizations best positioned to build the transition are not the same ones that should certify it.