[Debian-uk] Developer Authentication within Debian

[Jonathan McDowell]

On Tue, Nov 03, 2026 at 04:44:28PM +0000, Andy Simpkins wrote:
> Over the past few years I have been suggesting that the approach of a
> functional Quantum Compute Machine will put our existing Asymmetric Security
> systems at risk of compromise.
> 
> I suggested at the Cambridge Miniconf 3 years ago that we had between 5 and
> 10 years before a functional QC is able to compromise our existing PKI.
> 
> I am not a lone voice...  The USA has shortened it's timelines requiring
> General Encryption & Key Establishment to be implemented by Dec 31, 2030 and
> Digital Signatures & Authentication be implemented no later than Dec 31,
> 2031
> 
> Debian is not obliged to follow, but this is the point that governments are
> placing deadlines for deployment of PQC.  I would very much like Debian to
> have moved to 'a PQC' authentication system before our existing keys are
> considered 'at risk'
> 
> Can we have a discussion at the Miniconf on Friday afternoon to consider the
> possible options, and come to some kind of consensus (better yet a plan of
> works) to present to the wider project as a whole?

We need to distinguish between migration required due to the risk of 
store now, decrypt later attacks (encrypted data), and migration "just" 
required before conventional asymmetric signatures are broken, but it's 
definitely a conversation we should be having, and I'll be around on 
Friday to participate.

J.

-- 
 "Coming off Usenet is worse than  |  .''`.  Debian GNU/Linux Developer
   coming off heroin." -- Peter    | : :' :  Happy to accept PGP signed
              Corlett              | `. `'   or encrypted mail - RSA
                                   |   `-    key on the keyservers.