While the main focus of reporting over the past two weeks was on TPM chips underpinning the BitLocker disk encryption, the problem also impacts a range of smart cards used for high-security applications.
While the technical details of the attack have been just published in the ACM Digital Library yesterday, there is still a lot of work for cybersecurity teams and sysadmins to assess their exposure and fix what can be fixed. If you haven't heard of it yet, just google "ROCA vulnerability", or visit Ars Technica here and here. If you heard and want to hear more details, The ACM Digital Library has just published the full text of the research paper describing the details of the problem.
While quantum cryptography is still some years away from being anything but an interesting research area. the ROCA vulnerability gives us a taste of what it may look like once quantum computers are switched on.
You implement an encryption system to protect your high-security data when off-premise. You have a good security policy, a mechanism to revoke keys that may have been compromised and use secure hardware (smart cards) to minimize this risk of keys getting compromised. October 16th comes and you suddenly learn that it is possible to decrypt all your sensitive data without any additional information - all that is needed is included with the data, namely public keys used for encryption.
You can revoke the keys but the data is out there and there's no way to hide it now. All you can do is to hope that there are so many other companies, that your IT supplier will be helpful, that you know of all the copies of your data, that no one will find your data worth $20,000 (or maybe just $500 dollars when November comes and black hats optimize the attack) to crack the key. And it's not just an odd key where a smart-card has been misplaced, but all keys are suddenly vulnerable.
There may be lessons to be learnt but the first task one has to get done is to figure out the exposure and contain the risk as much as possible.
The original announcement of the research team - https://crocs.fi.muni.cz/public/papers/rsa_ccs17
Enigma Bridge online key testing tool (with a link to a Python tool to download) - https://keychest.net/roca
CERT/CC link - http://www.kb.cert.org/vuls/id/307015