“Please, please please go and take a look at CNSA2.0 guideline. It is going to affect you, and this threat is real, and you need to protect your data.” That’s the wake-up call Mamta Gupta, Senior Director at Lattice Semiconductor, issued during her appearance on Shielded: The Last Line of Cyber Defense. And it’s one the industry can’t afford to ignore.
For many, the threat of quantum computing still feels like a distant concern. But Gupta’s message is clear: the threat is already active. “They called it steal now, decrypt later,” she said, recalling a pivotal moment during a NIST and CNSA presentation. “They said, look, we are getting very concerned that… some nation state backed actors are actually harvesting data… and once quantum computers come online, they plan to break the encryption and actually steal that data.”
That moment shifted Gupta’s thinking from theoretical to urgent. “That was the moment for me that, oh, this is not about how fast quantum computers can get on my desktop… but it is about protecting data now so that it is safe for future… depending on your age, it’s all relevant. So if that data is going to be compromised, that needs to be protected today.”
Quantum computers capable of breaking current encryption might still be years away, but systems going into the field today will still be operating when those computers arrive. “If your device is going to be in market for next ten years and you are subject to CNSA 2.0 requirements, you should have started yesterday,” Gupta said.
And therein lies the problem: the cryptographic landscape is evolving fast—faster than most systems can keep up. “Implementation time lines, life cycle of hardware are on a completely different time line… While the threat evolution… is happening literally every two quarters,” she explained.
To address that disparity, Gupta emphasized the importance of crypto agility—the ability to update cryptographic protections without overhauling hardware. “You cannot afford to lock in something rigid, and that’s where crypto agility comes in… you have to think about crypto agility. Lot of people find agility and security oxymoronish, but this is what the need of the hour is.”
That shift in thinking led Lattice Semiconductor to run its own pilot program. “We started inventing those… Where are the use cases? Because every customer has a slightly different use case… and then we also started doing a hybrid pilot program… this pilot was very revealing because we realized, oh, we could fill it up very quickly because these PQC keys are big, very resource hungry.”
Gupta believes the most effective starting point is rethinking the root of trust. “In most critical systems, the root of trust is anchored in silicon,” she said. That’s where Lattice’s FPGAs come into play. “We have built in crypto agility… So you can put an algorithm in there that will be hardened into the FPGA fabric… that gives you that hardware root of trust.”
This flexibility is vital for long-lifecycle systems that need to keep pace with evolving standards. “You can upgrade without swapping out the hardware… you just have to upgrade the bit stream… and the FPGA will now wake up with the new algorithm.”
It also enables hybrid cryptography, running both classical and post-quantum algorithms during the transition period. “Currently in this transition period for at least next five years, we see that hybrid cryptography is extremely important.”
But hybrid brings complexity too. “Nothing is free,” Gupta said. “So if you are going to run two algorithms… performance will suffer a little bit… you will have to carefully architect your hybrid solution to see that you have enough space.”
Regulations are forcing decisions now. “CNSA is very crystal clear in that they have a cutoff date, 2030… every trust anchor shall move to PQC. There is no hybrid… CNSA doesn’t prefer hybrid. They say no. No hybrid will be used in protecting national secrets.”
Europe is taking a different tack. “ANISA in Europe… they have actually required now… that if you are using MLDSA and CHEM… then the requirement doesn’t ask you to do hybrid,” she explained. “But the new ones, MLDSA and KEM, which everybody is racing to adopt, they must keep hybrid also.”
This divergence is already impacting procurement. “When I used to approach customers in ’22… they’d say, oh, no. I’m big enough. I’ll get exceptions. And the same customers have come back to us because their boxes got rejected.”
So what should organizations do in the next 12 months? Gupta offered a clear answer: “Get visibility into your systems… look at how your firmware is being protected, how your trust anchors are being established… and are your vendors ready?”
Because in the end, the message is simple. “If your hardware will be in-market in 2030, you should’ve started your PQC transition yesterday.”
You can hear the full conversation with Mamta Gupta on Shielded: The Last Line of Cyber Defense, available now on Apple Podcasts, Spotify, and YouTube Podcasts.
About Lattice Semiconductor
Lattice Semiconductor is a global leader in low-power, programmable solutions. Their innovative FPGA technology enables secure, adaptable, and efficient designs across communications, computing, industrial, automotive, and consumer markets. Lattice’s devices play a critical role in securing digital infrastructure, serving as root-of-trust anchors for hardware platforms in an era where post-quantum security is fast becoming a global imperative.