Microsoft puts post-quantum interoperability to a real-world test

Post-quantum interoperability is about more than just individual algorithms working. As quantum readiness shifts from planning to implementation, testing becomes crucial for bridging the gap between technical standards and deployable protections. Microsoft, a leader in this effort, is working with certificate authorities to ensure their systems can handle post-quantum cryptography (PQC).

Karina Sirota Goodley, a senior security product manager at Microsoft, emphasizes that the company's approach is rooted in real-world customer needs. "We don't start with a cryptographically interesting solution and then look for a use case," she explained. "Instead, we begin with a real customer or business problem, understanding its operational constraints, and build a solution that works across all platforms, protocols, certificate authorities (CAs), devices, and existing infrastructure."

Goodley spoke with Lakshmi Hanspal, DigiCert's chief trust officer, during an exclusive broadcast on theCUBE, SiliconANGLE Media's livestreaming studio, about Microsoft's testing with certificate authorities, including DigiCert. They discussed the role of suppliers in making migration practical. Microsoft's Trusted Root Program is currently running a PQC pilot for Transport Layer Security (TLS) in a controlled environment, with DigiCert among seven participating certificate authorities.

Goodley stressed that certificate authorities must test issuance and compatibility with Microsoft's platform capabilities. "No single component can declare success; the whole chain has to work," she said. Microsoft treats vendor dependencies as an integral part of its readiness program, addressing them early to avoid issues later.

Goodley advises, "Make PQC migration your problem before it becomes your customer's problem. Deliver crypto agility, transparency, and standards-based interoperability by default. Customers shouldn't have to become cryptographers to prepare for the quantum era." If the industry aligns on interoperable implementations and removes complexity, quantum readiness will progress much faster than if each company tackles the problem independently.