Quantum Readiness Must Be Independently Validated, Dr. Peter Huynh Tells Leaders at HPT D-DAY 2026
Dr. Peter Huynh speaking in the Real Security Session at HPT D-DAY 2026.
Speaking in the Real Security Session on “Quantum-Safe Security Readiness: From Discovery to Independent Validation,” he set out what a bank must do to prepare and how it can prove it is ready. SpecterAI took part as a Silver Companion of the forum, hosted by HPT Vietnam Corporation under the theme R³: Real Technology, Real Operation, Real Result.
The attack has already started
He opened with “harvest now, decrypt later”: adversaries copy encrypted traffic today, store it cheaply, and wait until a quantum computer can break the cryptography protecting it.
“The theft happens now. Only the decryption is left for later,” Dr. Huynh said. “The real question is which secrets must stay protected for ten or twenty years, and whether they cross networks protected by RSA or elliptic-curve cryptography today.”
The weakness sits in public-key cryptography. RSA and elliptic-curve cryptography underpin TLS and transaction signing, and Shor’s algorithm breaks both on a large enough quantum computer; AES-256 is weakened but not broken. The U.S. National Institute of Standards and Technology has standardized the replacements: ML-KEM (FIPS 203) for key establishment, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures.
Rather than predict a year, he used the framework of Professor Michele Mosca of the University of Waterloo: if the time data must stay confidential (X) plus the time a migration takes (Y) exceeds the time until a capable quantum computer exists (Z), data protected today is already at risk.
“The only lever leaders hold is Y, and the way to shorten it is a disciplined program that starts now,” he said.
Five stages to quantum-safe readiness.
Each stage came with a banking example:
• Discover: build a complete cryptographic inventory, including undocumented places such as libraries hard-coded into mobile banking apps, keys in ATMs and point-of-sale terminals, and core banking components.
• Classify: rank data by how long it must stay confidential. One-time passwords expire in minutes; KYC records, 30-year mortgage contracts and root certificates do not. Biometric data needs particular care: “A password can be changed in thirty seconds. Nobody can change their face or their fingerprints.”
• Assess: prioritize by real exposure, not visibility. A quiet interbank link can outrank a busy dashboard, and hardware security modules come first: if they cannot support post-quantum algorithms, every later migration is blocked.
• Migrate: deploy hybrid cryptography, such as X25519 combined with ML-KEM-768 in TLS 1.3; design for crypto-agility so algorithms are configurable rather than hard-coded; and write post-quantum requirements into procurement contracts.
• Validate: confirm with evidence that post-quantum algorithms are running in production.
On validation, he warned of “silent fallback.” Like a 5G phone dropping to 4G without warning, a correctly configured hybrid connection can quietly revert to classical cryptography when a partner’s system does not support the new algorithms. Transactions continue, dashboards stay green, and the protection is gone.
The central message: independence
“No organization can independently validate work it performed itself,” Dr. Huynh said. “This is not a judgment about anyone’s capability. The team that designed and configured a system is the least likely to find the failure it did not anticipate, because it built the system on its own assumptions.”
Banking already applies this to internal audit and penetration testing. Internal teams and partners should discover, classify, assess and migrate; validation should come from a party that did not do the work.
He closed with three principles:
• Separate building from checking. Teams that implement should not validate.
• Define the evidence before migrating. Agree what “ready” means for each system and how it will be demonstrated.
• Validate continuously. Systems, partners and patches keep changing.
“Migration needs the hands of the people who know your systems best,” Dr. Huynh concluded. “But assurance can only come from independent eyes.”
About Dr. Peter Huynh
Dr. Peter Huynh (Huỳnh Vĩnh Phúc) is Chairman APAC of SpecterAI Quantum Security, Co-Founder and Vice President of CIO Vietnam, a technology community, and a Professional Fellow of the Responsible Fintech Institute. He has more than 30 years of enterprise technology experience with IBM, Salesforce, Gartner and HP.
About SpecterAI Quantum Security
SpecterAI Quantum Security is a post-quantum cryptography firm headquartered in Ho Chi Minh City, Vietnam, providing cryptographic assessment, independent validation and training to banks, enterprises and public-sector organizations across the Asia-Pacific region.
Duc Mai - General Counsel
Specter AI Quantum Security
+84 93 421 14 84
duc.mai@specterai.vn
Visit us on social media:
LinkedIn
Facebook
YouTube
Legal Disclaimer:
EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
