An Interview with a Canadian Cryptography Pioneer

Bruno Couillard shares his experience building world-leading hardware security solutions in Canada

This week I interviewed Bruno Couillard, the CEO of Crypto4A, an engineer who has spent a decades-long career building the hardware security solutions that have underpinned trust on the internet for decades. Through Crypto4A, he seeks to do the same for a world where quantum computing is a reality and where legacy cryptographic solutions are no longer an option.

My goal in this interview was to better understand Canada’s contribution to this space and the opportunities before us as we reorient our economy toward security, sovereignty, and defense. Bruno’s insights touch on the foundations of what digital sovereignty means practically and how security and trust on the internet will evolve as we move toward a world in which quantum computing is a reality.

Bruno also makes clear that Canada has made globally leading contributions to cybersecurity that it has mostly failed to benefit from economically to date, and that we have a rare second chance to get it right as quantum computing becomes practical and the world shifts its priorities toward digital sovereignty.

Your email client will probably truncate this post. My key takeaways are presented at the end, so be sure to read the web version if you want to get the whole story. Many thanks to Bruno for sharing his experience and insight.

Interviewer’s note: Bruno Couillard and the Crypto4A team approved the final version of the section entitled “Interview with Bruno Couillard” and had editorial input on that section, with the option to rephrase and expand on the ideas discussed in the interview without changing or removing any intended meaning. The key takeaways presented at the end are my own commentary, and do not necessarily represent the views of Crypto4A or its employees.

Interview with Bruno Couillard

KB: How’d you find your way into quantum cryptography?

BC: My journey into cryptography and key management began in 1988. I had just finished my military officer training at the Royal Military College, and I was assigned to a fascinating project in Ottawa called the Integrated Data Network (IDN). It was essentially a Canadian Forces–wide internet, connecting all bases across Canada and even the two we had in Germany at the time.

The IDN relied on a mix of link and end-to-end encryption, securing both classified and protected information. Fresh out of engineering school, I was eager to contribute, and I got assigned to the cryptography and key management side of things. Back then, these concepts weren’t taught in school you had to learn them on your own. I dove in, and it was love at first sight. That set the course for my career: cryptography, key management, and public key infrastructure have been my focus for 37 years now.

From IDN, I moved to the Communications Security Establishment (CSE) in 1992. Then, just as the Internet was taking off in 1994, I left to co-found Chrysalis ITS in Ottawa. As CTO and co-founder, I transitioned from theory into practice designing and evolving hardware products. That’s where I created the Luna HSM, which became a leading Hardware Security Module worldwide. I also helped shape standards like PKCS#11 and contributed to best practices around root key ceremonies. After almost a decade, I left Chrysalis in 2003.

Editor’s note: A Hardware Security Module (HSM) is a dedicated physical device designed to securely generate, store, and manage cryptographic keys. HSMs perform operations such as encryption, decryption, digital signing, and key generation within a tamper-resistant environment. They are foundational to the security of systems that require strong encryption and regulatory compliance such as banking, cloud operations, and secure communications, and are key elements of public key infrastructure (PKI).

At that point, I wanted to recharge and spend more time with my family. My wife and I have three sons who were busy with school, sports, and music. I rebranded myself as a consultant and returned to projects with DND and CSE. It felt like going back to my roots, but with new perspective: instead of focusing on commercial HSMs, I was working on high-grade security systems.

Around 2003, one of the major efforts was modernizing cryptography and key management across allied security systems. The idea was to migrate algorithms quickly enough to withstand advances in general-purpose computing. I was heavily involved in Suite A and Suite B crypto right from their inception.

Then, in 2009, the NSA published a pivotal statement: it wasn’t general-purpose computers we needed to worry about anymore, it was quantum computers. Practically overnight, post-quantum cryptography (PQC) became the main focus. That announcement grabbed my attention. I began watching closely, wondering if anyone in the commercial HSM market was preparing for this challenge. To my surprise, no one was.

That’s when I started thinking about building a new HSM from scratch something designed from the ground up to be quantum-safe and ready for the fast-evolving digital economy. Together with some long-time colleagues from Chrysalis, we decided to take the leap. And that’s how Crypto4A was born.

From day one, our vision was clear: Crypto4A would create the HSM built to survive and thrive in a quantum era. These devices matter because they sit at the very center of the digital economy, which now represents more than a third of the global economy. This all traces back to 1995, when Netscape introduced SSL for secure browsing. Behind that were authentication certificates issued by Entrust or Verisign, and guarding those authorities was the Luna HSM. That triad, SSL, PKI, and HSM remains the foundation of digital trust today.

Over the past 30 years, we’ve only layered more services onto that same foundation: banking, government, identity, communications, everything. And behind it all, somewhere in the background, an HSM protects the root keys of trust. Having been part of the team that created the first successful generation of HSMs, I felt it was our responsibility to build the next generation this time quantum safe.

Life has given me incredible opportunities to be at the right place, right time, with the right people, participating in one of humanity’s greatest transformations: digitizing a third of the global economy in just three decades. Now, we’re entering the next major transitions; AI today, quantum tomorrow. But none of it will be possible unless the foundations of digital trust we laid down in 1995 are made quantum-safe and continue to hold strong for decades to come.

KB: Where are Canada and the rest of the allies in terms of replacing their hardware stack to make it quantum resistant?

BC: If you had asked me this question six to eight months ago, I would have said the United States was clearly leading the world in this push, with Europe and Canada following behind.

But today, I’d say Canada is really stepping up to the plate and starting to take a much more significant leadership role. What’s interesting is that this is happening at a critical moment for the digital economy. Two major themes, trust and sovereignty, have now joined the conversation alongside quantum readiness.

If we’re going to build the capabilities and technology stack for the future, its foundation, cryptography, must be quantum safe. That means protecting the root of trust while also ensuring sovereignty of its operations. Put simply, there is no digital sovereignty without cryptographic sovereignty. And this is exactly where HSMs come in, and where Canada has a real opportunity to lead.

On the political front, our leaders have been making bold statements over the past few months. We’re hearing strong, visible messages from the highest levels of government about the sovereignty of our information and the urgency of preparing for the quantum era. Even at the recent G7 meeting in Canada, quantum realities were flagged as a concern on the global agenda. Data sovereignty is no longer a niche issue; it’s now front and center here at home and around the world.

Of course, the real test will be whether these political commitments can make their way through the machinery of government to create meaningful action. That’s never easy. Cryptography underpins so much of our world that it’s almost easier to list the things that don’t use it than the ones that do.

The good news is that Canada has an incredible foundation to build on. We’ve been investing in cryptography and key management since the early 1990s, when PKI and HSM technologies first took root here. That’s when both Entrust and Chrysalis-ITS were born out of the Nortel/BNR era. Those companies became the backbone of the modern digital economy, and their DNA is still very present in Ottawa today.

The Luna HSM design team, now part of Thales, still works out of Ottawa South. Entrust’s PKI team is still in Kanata. Crypto4A itself was founded by former Chrysalis-ITS and Entrust engineers. Taken together, Ottawa, and by extension Canada, likely represents the highest concentration of cryptographic and key management expertise anywhere in the world.

For some reason, we became very good at this discipline. And, true to Canadian form, we don’t brag about it. But we should. Because the reality is: Canada owns some of the most critical pieces of this global puzzle. And given the scale and complexity of what lies ahead, I’d much rather be tackling this challenge here in Ottawa, Canada, than anywhere else on the planet.

KB: Beyond encryption breaking, what’s the business case for quantum cryptography? What’s real and what’s hype in the current thinking around capabilities relating to quantum cryptography?

BC: Before I dive in, let me refine the question a little. The real capability we’re worried about isn’t just “quantum cryptography” in the broad sense, it’s the arrival of quantum computers powerful enough to run Shor’s algorithm. Once that becomes possible, whoever controls that capability will be able to break virtually all the classical public key cryptography we rely on today. That’s why there’s a global race underway to migrate as quickly as possible to post-quantum cryptography, or PQC.

Now, when people hear “quantum cryptography,” they often confuse two very different things. What I just described is PQC developing new, quantum-resistant algorithms to replace the ones we use today. But there’s also a field properly called quantum cryptography, which uses the principles of quantum mechanics, things like entanglement and superposition to achieve new forms of security.

One of the best-known examples is Quantum Key Distribution, or QKD. It allows cryptographic keys to be generated at two different locations in such a way that both parties can be confident the key is identical, and that it hasn’t and in fact can’t be copied or intercepted anywhere else in the universe. This concept was first introduced in 1984 by Charles Bennett and Gilles Brassard in what became known as the BB84 protocol. Since then, several variations have been developed, but they all rely on the same unbreakable quantum mechanics principles.

We’ve already seen some remarkable demonstrations. China, for instance, has deployed advanced QKD networks and even tested satellite-based systems where secure keys were exchanged between Earth-based stations and satellites in orbit. These are fascinating achievements and hint at some powerful niche applications in the future.

That said, it’s important to keep perspective. QKD isn’t a wholesale replacement for the cryptography we use today. It addresses certain use cases very well, but it won’t solve the broader challenge. Most of our digital systems from banking and government to cloud and communications will continue to depend on PQC. In practice, QKD should be seen as a complement to PQC, not a substitute.

So, to your question of what’s real and what’s hype: the urgent and unavoidable business case is defensive replacing our current cryptography with PQC before Shor-capable quantum computers arrive. QKD is real as well, but more specialized, and won’t replace everything. The hype comes when people conflate the two or imagine QKD is going to single-handedly secure the digital world. PQC is the foundation we must address first, and QKD is an exciting complement that will play a role in specific scenarios.

KB: Can you speak to the limitations that prevent QKD being a replacement for more traditional cryptography methods?

BC: The limitation with QKD is really about practicality and scope. For example, if you and I wanted to set up a QKD-secured session between our two locations, we’d need a dedicated fiber optic cable connecting us. If the distance was too long, we’d have to rely on multiple QKD segments or even use a satellite-based system. That works well for “real-time” sessions securing data in transit, but it doesn’t solve long-term security needs.

Take something as simple as buying a house. If I sign a digital contract today, that signature has to remain valid not just tomorrow, but 20 or 50 years from now, so I can still prove I own my home. That requires a digital stamp that will stand the test of time. QKD can’t do that. Only PQC algorithms can provide the kind of durable digital signatures needed for those use cases.

The same applies to countless everyday examples. If you buy a smart car, the manufacturer will send firmware updates for years. Each update must be digitally signed to guarantee authenticity and integrity. In the quantum era, PQC algorithms will be the only way to achieve that. The same holds true for critical medical devices like pacemakers or insulin pumps, where firmware updates must be trusted without question.

That’s why there’s such urgency around migrating these systems now. Once a satellite is launched, or a medical device is implanted, or a long-term legal contract is signed, the cryptographic signature tied to it has to remain secure for decades. Those are “long-lived signatures,” and they absolutely must be quantum safe.

If you look at the landscape, there are thousands upon thousands of use cases where we’ll need to authenticate, verify, and preserve the integrity of digital artifacts in our lives. All of those still exist in the digital world of ones and zeros. We haven’t moved into a pure world of photons and light yet and we likely won’t in our lifetimes.

So, for now, and for many years to come, our security will continue to depend on PQC. QKD is exciting, but its use cases are in the dozens, not the thousands. It’s worth experimenting with, but it’s not “the next security solution.” It’s a complement. The heavy lifting will remain with digital cryptography zeros and ones for a long time.

KB: “Quantum” as an umbrella term has entered pop culture and often means different things to different people. What are some common misunderstandings and misconceptions that you encounter?

BC: Early on, there was a lot of hype around quantum. People talked about it as if it were a panacea that it would solve every problem and usher in a perfect future where we all lived on a cloud. The reality is much different. Quantum technologies are extremely hard, very expensive, and although they will eventually be amazing for many applications, we are still far from realizing all their promises. One day, yes, we’ll use quantum computers as naturally as we use classical computers now. But today, we’re still in the early stages.

This hype phase has a downside: customers get bombarded with messages that range from the realistic to the completely ridiculous. That noise makes it difficult for those of us focused on a secure transition to the quantum era to cut through especially when it comes to post-quantum cryptography. Too often, people think the solution is as simple as deploying quantum key distribution everywhere.

Another challenge is language. Many of the terms are not yet fully standardized, so people use them interchangeably even when they mean very different things. Fortunately, if you read Canada’s National Quantum Strategy, or other national strategies, you see a clearer framework emerging for the different “buckets” of quantum technology.

The first bucket is quantum computing. These are machines that replace today’s ones and zeros with photons or other quantum particles, and that can run true quantum algorithms. One of the most powerful, and frightening, of these algorithms is Shor’s algorithm. Discovered in 1994, it can break every classical public key cryptosystem: RSA, DSA, ECDSA, Diffie-Hellman, and more. This is what launched the global race to build such machines, with billions invested so far. Roughly half of that investment has come from China, and it would be naïve to think their priority is only better materials science or drug design. The more immediate goal could be breaking our current cryptography. If that happens, the consequences would be catastrophic: our banking system would fail, our digital economy would collapse, and society itself would grind to a halt because the Internet could no longer be trusted. Every sector of our lives, from mining to farming, already depends on secure digital connections. Without trust in the Internet, modern society doesn’t function.

The second bucket is quantum sensing, which I find fascinating. By harnessing quantum effects, you can detect incredibly faint signals: mapping mineral deposits deep underground, exploring the oceans, reading subtle electrical signals in the human brain, even probing signals from the far reaches of the universe. Compared to these advances, our classical sensors will look primitive. Of all the quantum technologies, I think sensing may have some of the most profoundly positive impacts.

The third is quantum communication, and this is where confusion tends to multiply. It includes things like quantum key distribution, which we’ve already discussed, as well as quantum teleportation, the idea of transmitting particles across distances to create new forms of communication. Another element is quantum random number generation, where we harness inherently unpredictable quantum processes, like radioactive decay or photon behavior, to create true randomness.

Finally, there is post-quantum cryptography. Strictly speaking, PQC is not “quantum” in that, it is not strictly speaking based on quantum mechanical principals at its core. Instead, it uses advanced mathematical algorithms designed to withstand both classical and quantum attacks. PQC exists for one reason: to ensure our digital infrastructure remains secure in a quantum world. At Crypto4A, we’ve built a new generation of cybersecurity products around this principle. Our solutions still operate with ones and zeros, but they use the new algorithms that NIST has been standardizing after an eight-year global competition. Three were standardized in August 2024 and more will follow in the coming years. From now on, it’s not enough for systems to be quantum-safe they must also be crypto-agile, able to adapt as algorithms evolve.

This is where misconceptions really take hold. Some vendors will say that because they have a quantum random number generator, their products are “quantum ready.” Others claim QKD or teleportation will solve every security challenge. Some even suggest they can magically make a classical device quantum-safe with a quick patch. None of that is true. To be truly quantum-ready, you have to redesign your entire stack to survive in a world where quantum computers exist. Every element has to be tested against that future reality. The litmus test is simple: imagine your design in the year 2040. Quantum computers are everywhere. Could a hacker in that world break your system? If the answer is yes, then you’re not quantum ready.

KB: Taking that one step further, what should governments and businesses be doing right now? How long do they have to get it done?

BC: We already solved this kind of problem once before. Thirty years ago, November 1995, we figured out how to make the Internet a trusted environment for business. That was when Netscape introduced SSL, completing what I call the “digital trust foundation.” SSL secured communications between browsers and servers, PKI technologies from Verisign and Entrust allowed Certificate Authorities to issue SSL certificates, and the Luna HSM that we had developed at Chrysalis-ITS here in Ottawa, underpinned the cryptography at the core. Those three pieces, SSL, PKI, and HSM, are still the same foundation the Internet rests on today.

To get to a quantum-safe world, we need to repeat that process. First, deploy quantum-safe HSMs. Then, make PKI quantum safe. And finally, update Internet standards and protocols so they can use quantum-safe certificates. You start at the foundation and work your way up the stack. Whether you’re a bank, a government, a manufacturer, a transport system, or an energy grid operator, the first step is the same: begin deploying quantum-safe HSMs.

At Crypto4A, we’ve built these next-generation HSMs. They’re quantum-safe by design, highly specialized machines that we can produce at scale. But like any physical component, supply is not infinite. Think back to COVID, when everyone suddenly needed masks and gloves, the lineups were endless, and prices spiked. The same will happen if organizations wait until the moment a breakthrough in quantum computing arrives. If you start now, the migration can be steady and manageable. If you wait, it will be chaotic and costly.

There’s no downside to moving early. I always recommend that governments, banks, and anyone providing trusted services get started right away. Canada has a chance to turn this into a national advantage. We’ve always punched above our weight in cybersecurity. If we make quantum-safe migration a major national project, Canada could cement itself as a global leader for decades to come.

And this isn’t just about technology. The digital economy, the intangible economy, is already outpacing the tangible one. In that reality, leading the world in securing cyberspace is the equivalent of having the strongest defense forces. It’s a matter of national strength and sovereignty.

KB: In a military context there is a need to build systems that allow for interoperability with allies, which points to the need for standards that are agreed internationally. Does Canada have a role to play in defining those standards?

BC: I’d say Canada is already very involved in shaping these standards. Over the past 30 years, much of cyberspace has been built through the work of international standards bodies groups of volunteers who dedicate their time and expertise to advancing the protocols we all depend on. One of the most important of these is the Internet Engineering Task Force, or IETF, which was founded more than 60 years ago and continues to evolve the core protocols of the Internet today.

Crypto4A actively participates in this work. We’ve contributed to efforts at the IETF, and we’ve been deeply involved in the post-quantum cryptography standardization process led by NIST. Our team has consistently pushed the envelope on quantum-safe design, because our mission is to ensure cyberspace remains secure and trusted for generations to come.

We’re also proud to be the leading HSM vendor in the quantum migration project run by the National Cybersecurity Center of Excellence (NCCoE), a lab under NIST in Maryland. That project brings together the world’s top cybersecurity companies to demonstrate interoperability of quantum-safe cryptography and related standards. Since its launch in 2022, we’ve led the HSM interoperability testing and have consistently delivered fully functional, standards-compliant products some of which are already deployed in live operational systems today.

And it’s not just us. The Government of Canada itself has a strong presence in these efforts, with experts participating in NIST’s standardization process, the evolution of IETF protocols, and other international bodies. Taken together, Canada’s contributions are significant. We’re not just observers we’re helping shape the very standards that will define how the world transitions to a quantum-safe future.

KB: Following the Luna HSM over the years, it has been the target of 4 acquisitions, the first of which caused Canada to lose control of this IP. It is still in service now, decades later, as part of the Thales Group IP portfolio. Tell us the story of what led to the original decision to sell the IP. What needs to happen differently this time around if we want Canada to lead in the post-quantum HSM space?

BC: After coming out of a military and government career, I wanted to build something to put into practice all the theory I had developed on how to ensure trust in the digital world. I co-founded Chrysalis, focusing on the technical side of things while my co-founder ran the business.

From 1994-1998 we designed the Luna HSM, and by 1998 we were selling it to the US, Canada, a few European countries, and Japan. A lot of our sales were alongside Entrust sales or directly to Verisign, forming the foundations of public key encryption (PKI). In 1998, the dotcom bubble was well underway, though, and chip-design was all investors wanted to hear about. Our investors decided that we needed to design a chip. We tried and failed to find a contractor that could design it, and eventually hired some very expensive in-house expertise to do it. We almost did, but in 2001, the board decided to pull the plug on all the semiconductor work. My co-founder was let go on August 15, 2001, along with 100 other people, and I was told to stay on as CTO and to go back to our roots with the Luna HSM and a number of other projects. September 11 happened a few weeks later, and the company almost disappeared. In 2003, after two years of intense efforts, we’d managed to turn things around with the introduction of the world’s first network-attached LunaHSM with very promising sales results. At that point, I decided to refocus my energy on my young family with my wife, left Chrysalis and transitioned into a consulting role with the Canadian Government. Shortly thereafter, Chrysalis was sold at a bargain price, basically just to acquire the IP.

That Luna HSM IP went on to become the global standard for its purpose and is still in use today, but it was lost to the Canadian ecosystem in 2003. It has since been sold several more times - from Chrysalis it went to Rainbow Technologies, then SafeNet, then Gemalto, and most recently to Thales. Given the value that IP has created in the world since it was first sold, I think that a Chrysalis that had stayed fully focused on the HSM instead of getting side tracked by semiconductor hype might still be alive and Canadian today. If there was a mistake made, aside from the semiconductor mess, it was simply not recognizing the value of the IP that we had and being relatively junior to the process of building a company.

Crypto4A is a second chance to do the same thing for a post-quantum world what LunaHSM did for the early internet: ensure the future strength, security, and trust of the internet in the upcoming quantum era. Someone is going to do it, because otherwise the internet stops working.

This is especially critical as we start to talk about data sovereignty. The only way you enforce security capabilities is by controlling the keys used for the cryptographic processes that secure your data. Without that control, all bets are off. You cannot ever allow data to be sent abroad and let someone else control the keys: no key, no sovereignty.

I believe what we are building is the world’s best technology for its purpose and that it will have the same longevity as the Luna HSM. I can assure you that I know far more today than I did when designing the LunaHSM - we will not make the same mistakes twice.

KB: What should I have asked you but didn’t?

BC: One of the biggest challenges right now is clarity, separating truth from noise. There’s so much misinformation, hype, and fearmongering out there that it becomes very difficult for people outside our “inner circle” to focus on what really matters.

Decision-makers today are bombarded with messages and marketing claims, many of them contradictory. That’s why your role as someone who listens to these different voices and distills them into something understandable and neutral for policymakers, lawmakers, and planners is so critical. You may not be an expert in quantum technologies or cryptographic algorithms, but you still have to make sense of it all and present it in a way that drives sound decisions. That’s not easy.

It’s something I think about a lot in my own organization. We recently brought in our first marketing lead, and one of my requirements was that they not come from a cryptography or key management background. I didn’t want someone who would immediately slip into the jargon we use among ourselves. I wanted someone who could translate our work into clear, accessible language for a broader audience.

It’s hard to do that when you’ve been immersed in the technical soup for 35 years, as I have. If you’re starting a quantum computing company, chances are you’ve just finished a PhD in physics and you’re ready to build machines. If you’re starting a cryptography company, you’ve probably been steeped in algorithms and key management your whole life. And when that’s your world, it becomes difficult to step outside of it and explain your work in terms your mom or dad would understand.

That’s the challenge we face, and it’s the challenge you face as a journalist. Taking these incredibly complex, technical topics and rendering them into something that makes sense to the people who need to make critical decisions for our collective future. It’s not just important; it’s essential.

Despite the complexity, I see this as one of the most exciting times to be alive. We’re navigating unprecedented technological transitions, and we have the chance to ensure that the world of tomorrow is secure, trusted, and resilient. We really are living in one of the greatest eras.

Although you did not directly ask me this question, let me share what I would do if I could make one critical strategic decision for Canada today.

I would launch a national initiative called “Quantum-Safe Trust Infrastructure.” Like Churchill Port or the Trans Mountain Pipeline, this would be a nation-building project—except this one secures the cyberspace underpinning our digital economy and critical infrastructure.

This initiative would include:

• Establishing a strategic reserve of ready-to-deploy quantum-safe hardware.

• An immediate transition of all federal IT systems to quantum-safe standards.

• A mandate for the Bank of Canada to lead the migration, followed by the broader banking sector.

• A national program to work with provinces and critical infrastructure owners to migrate their IT and OT systems without delay.

• A workforce training and incentive program to ensure Canada has the talent required to deploy and maintain quantum-safe technologies at scale.

The foundation for this project already exists. It is 100% Canadian, and it represents the world’s most advanced capability in this domain. We have the technology, the people, the manufacturing capacity, and the expertise to act—right now.

By treating cyberspace as a new dimension of national defense—alongside land, sea, and air—investments in this project would also count toward Canada’s NATO commitments. More than that, Canada could position itself as the Quantum-Safe Trust Infrastructure provider of choice for all our allies.

This is a “now” project. One that secures Canada’s leadership, sovereignty, and trust in the quantum era.

Key Takeaways

A rare second chance

As I explore the Canadian innovation space, I often find myself surprised, not only at the pioneering contributions that Canadians had made to the technologies that quietly operate in the background of the modern world, but at how unassuming Canadians are when they discuss their contributions. Bruno tells the story of contributing core intellectual property (IP) to the foundations of digital security, IP that has been in productive use for three decades and counting, and he tells it without any pretentiousness.

I was less surprised to learn that Canada no longer controls the IP he developed. The LunaHSM IP has been sold 4 times over its 30 years in service, first to US-based companies, and finally to Thales in France, generating enormous value in the process, value not enjoyed by Canada. In a bit of a break from the usual culprit, though, Bruno’s story doesn’t point to a specific policy failure as the reason for the original sale, simply a combination of timing that coincided with the initial semiconductor hype cycle, relative inexperience as a first-time founder, and investors chasing hype.

Unlike most similar stories, however, Canada has second chance to get it right. Crypto4A is trying to do for the internet what Chrysalis and the LunaHSM did for the nascent internet: provide a hardware level foundation for digital trust, but in a world in which quantum computers are the norm.

Digital sovereignty and nation-building

There is a lot of talk of “digital sovereignty” in response to the realization that American law trumps Canadian law for data controlled by American big tech. PM Carney has promised major investments in a Canadian sovereign cloud. The Canadian sovereign cloud could be a nation-building project or a campaign slogan, depending on whether or not we get the details right. Bruno’s commentary makes it clear that for this to work, Canada must control the keys through which all of this is secured. In his words: “no key, no sovereignty”.

While quantum computing is not yet here, Bruno’s commentary (and 30 years of real world demonstration) make clear that the hardware solutions that are deployed today to secure these keys must be ready for its arrival. Like the LunaHSM, many of the HSMs deployed now will operate for decades and be secure not just against today’s threats, but also those of the foreseeable future. No matter where you fall on your prediction of when quantum computing will be a reality, not even the most pessimistic estimates put it outside the operational lifetime of HSMs that are deployed today. The HSMs that secure the Canadian sovereign cloud must be quantum resistant.

Transitioning to quantum safe standards will have to happen sooner or later, and there is no downside to “sooner”. In Bruno’s words: “Someone is going to do it, because otherwise the internet stops working.”

The benefits are many-fold: getting ahead of a security threat that we can clearly see coming, if not exactly when; procuring solutions from a Canadian company that has the track record to prove their value while directly supporting a key nation-building effort focused on digital sovereignty; and providing opportunities for upskilling of Canadians across every sector of the economy that connects to the internet (i.e. all of it). All of this fits under the umbrella of increased defense spending mandates, and positions Canada as a leader among NATO allies with respect to quantum-resistant cryptography. As Bruno puts it:

“Canada has a chance to turn this into a national advantage. We’ve always punched above our weight in cybersecurity. If we make quantum-safe migration a major national project, Canada could cement itself as a global leader for decades to come.”

Last but not least, it provides a direct path for Canada to secure the economic benefits of world-leading IP in a technology will sooner or later be needed by the entire world. We already lost the LunaHSM, let’s make sure we don’t let that happen a second time.

Geopolitical and technological necessity set the stage for economic and security opportunity. Bruno’s commentary provides the roadmap for Canada to reap the benefits.

Many thanks to Bruno and the Crypto4A team for taking the time to do this interview and share their insights.