In an interview with Help Net Security, Dr. Yaakov Stein, VP CTO of Allot, outlined what post-quantum readiness looks like for a mobile carrier’s core network.
The discussion began with a look at traffic that retains sensitivity for years. Subscriber identity mappings, billing records and call metadata fall into that long‑life bucket, as does any flow that could expose passwords.
By contrast, ordinary voice calls, web browsing or video streaming become irrelevant after a few hours. Those data streams lose their confidentiality value quickly and do not drive immediate PQC concerns.
Financial transactions that involve credit‑card details remain sensitive for several years, but the protection is usually handled at the device level—by the subscriber’s browser or dedicated app.
Roadmap for a carrier’s first twelve weeks
Week 1 focuses on a complete inventory of public‑key cryptography usage. The inventory should capture 5G SBA interfaces, IKE for IPsec links, DNSSEC, encrypted APIs and any other PKI‑dependent component.
Related: AI AppSec Tools Agree on Only Five Percent
Weeks 2 and 3 move TLS‑protected interfaces—SBA, SEPP, web portals and OSS/BSS APIs—to a hybrid key‑exchange model. The preferred mix pairs X25519 ECC with ML‑KEM, and where possible a crypto‑agile fallback to HQC.
During weeks 4 and 5 the focus shifts to IPsec links, including backhaul, inter‑data‑center and LTE‑roaming connections. Migrating these tunnels to hybrid exchanges follows the same pattern as TLS.
Weeks 6 through 8 address any remaining protocols that rely on public keys, even proprietary ones that have slipped under the radar.
Once all key exchanges are hybrid, weeks 9 and 10 allow the carrier to consider authenticating long‑lived connections with the large public keys required by currently standardized PQC digital signatures. Short‑lived sessions can stay on legacy mechanisms for now.
Weeks 11 and 12 involve hardware‑based authentication and attestation, but only after vendors demonstrate they have ready solutions. Enterprise and governmental customers may need bespoke handling.
Related: Fake Bank Sites Go Dormant to Dodge Scanners
Vendor statements that should raise alarms
When a supplier answers a PQC question, the worst response is a simple “we don’t yet support PQC.” Even more concerning is “we are waiting for the standards to stabilize.” The interview notes that standards are moving faster than any previous telecom innovation, and delaying for “stability” undermines crypto‑agility.
Assessing a vendor’s readiness matters because a single overlooked component can undo months of work. If an operator upgrades most security layers but leaves an old component unpatched, the whole network inherits that weak spot. The risk is not a breakthrough in mathematics but a mundane operational slip.
The most common failure mode, according to the interview, is missing an interface. Operators then gain a false sense of security while the un‑updated link remains vulnerable.
In short, a carrier should start with a thorough crypto inventory, prioritize hybrid TLS key exchange, and avoid waiting for perfect standards or the arrival of quantum computers. The timeline feels stretched but it’s necessary; missing even one piece can leave the entire migration exposed.
