post-quantum cryptography

Bilingual

RFC 9851: TLS 1.2 is in Feature Freeze
a month ago
- TLS 1.3 is replacing TLS 1.2 due to security fixes like encrypted traffic and stronger cryptography.
- No further changes will be approved for TLS 1.2 except urgent security fixes, new TLS Exporter Labels, and ALPN Protocol IDs.
- Post-quantum cryptography (PQC) for TLS 1.2 will not be specified; users must upgrade to TLS 1.3 for quantum-safe security.
- TLS registries remain open but new entries must be intended for TLS 1.3 or later, not TLS 1.2.
- The document modifies IANA instructions to restrict TLS 1.2 entries and adds notes to 25 TLS registries.
NIST Develops New Standards to Safeguard Computers Against Quantum Threats
a month ago
- Cryptography protects data using math problems that are hard for current computers but quantum computers could break them.
- Post-quantum cryptography (PQC) aims to create new algorithms resistant to quantum computer attacks.
- The 'harvest now, decrypt later' threat means adversaries can collect encrypted data now and decrypt it later with quantum computers.
- NIST is developing new cryptographic standards through an open, transparent process involving global researchers.
- Migration to PQC is complex and must start early; organizations should inventory crypto usage, plan migration, and update systems.
- Users should keep systems updated; PQC will be adopted in software, browsers, and other tools over the next decade.
Some thoughts about Anthropic's new cryptanalysis results
2 months ago
- Anthropic's Claude Mythos produced two cryptanalysis results: a notable attack on the HAWK signature scheme and a modest improvement on reduced-round AES.
- The HAWK attack halves security bits using existing techniques, undermining the scheme's efficiency justification and its path to standardization.
- The AES attack targets a 7-round variant, requiring impractical resources (2^89 ops, 2^105 chosen plaintexts) and is only a minor improvement over 2013 work.
- AI can now synthesize existing cryptanalysis into new attacks, but verification remains a bottleneck requiring human expertise.
- Symmetric ciphers are robust, but public-key cryptography may be more vulnerable; the post-quantum transition is timely for AI-driven cryptanalysis.
- For scientists, AI offers a helpful collaborator; for the world, AI progress is real but not superintelligent, with uncertain implications.
Post-quantum public-key encryption: what’s it all about?
2 months ago
- Public-key cryptography basics: RSA uses prime numbers p, q; public key n=pq; encryption involves modular exponentiation; security relies on factoring difficulty.
- Post-quantum (PQ) cryptography is needed due to potential quantum computers breaking RSA and Diffie-Hellman; new systems are less understood.
- Author presents a toy PQ cryptosystem using vectors, matrices, and modular arithmetic to illustrate structure; it's not secure for real use.
- Toy system: private key = two small vectors (a0, a1); public key = A = a0 + T*a1 where T is random matrix; encryption adds noise via dot products.
- Decryption in toy system recovers message plus noise; decryption can fail due to noise accumulation, a feature shared by many real PQ systems.
- Real PQ systems (e.g., FrodoKEM, ML-KEM, HQC) follow similar additive structure but differ in algebraic spaces, parameter sizes, and noise handling.
- Other systems (BIKE, NTRU Prime) use multiplicative inversion; Classic McEliece uses error-correcting codes with huge public keys but no decryption failures.
- Security considerations: attackers face hard search problem among many plausible vectors; defenses include non-interactive proofs and seed-based key generation.
- Classic McEliece is the most conservative option but has large public keys; other systems balance efficiency and security.
Classical Acceptance Is Not Hybrid Authentication: Measuring X.509 Verifier
2 months ago
- Hybrid X.509 certificates with separable designs risk relying solely on classical authentication, ignoring post-quantum evidence.
- Experiments across eight validation stacks show most accept hybrid certificates based only on classical paths, not evaluating post-quantum credentials.
- When post-quantum credentials are revoked but classical certificates remain valid, default paths still accept due to credential exclusion from decision scope.
- The gap is structural, not due to missing primitive capabilities, and stems from standards not requiring verifiers to make post-quantum evidence outcome-bearing.
- A verifier model and policy-parametric contract are proposed to enforce proper hybrid authentication checks.
France's Anssi Will Block PQC-Free Products from Certification Starting 2027
2 months ago
- France's ANSSI will stop certifying security products lacking quantum-resistant encryption starting in 2027.
- Businesses are advised to purchase only quantum-safe products by 2030, as per ANSSI's chief of staff.
- ANSSI certification is mandatory for access to French government and critical infrastructure markets.
- The policy addresses 'Harvest Now, Decrypt Later' attacks, where encrypted data is stored for future quantum decryption.
- Industry demand for post-quantum cryptography (PQC) products is accelerating, with banks and public services assessing exposure.
- ANSSI's 2027 deadline parallels the NSA's CNSA 2.0 procurement gate, creating pressure on vendors across jurisdictions.
- ANSSI recommends hybrid PQC (combining classical and quantum algorithms), a stricter requirement than the NSA's approach.
- France's 2027 cutoff runs ahead of the EU's 2030 target for high-risk systems, positioning France as a leader in enforcement.
- Multinational vendors face compliance challenges from differing PQC standards in the U.S., France, and Germany.
- A 2025 study found that most organizations lack post-quantum transition plans, highlighting a significant preparedness gap.
We cannot wait for better post-quantum signature algorithms
2 months ago
- RSA and ECC are vulnerable to quantum attacks, but ML-KEM encryption and ML-DSA signatures are quantum-resistant and were standardized by NIST in 2024.
- Cloudflare aims for full post-quantum security by 2029, with most traffic already using ML-KEM, but signatures still need migration to protect authentication.
- ML-DSA has downsides like larger sizes compared to classical algorithms, and alternative post-quantum signature schemes are being developed, such as FN-DSA and others from NIST's third round.
- New signature schemes like SQIsign offer small signatures but slow signing, UOV has tiny signatures but huge public keys, and stateful hash-based signatures require careful state management.
- FN-DSA (Falcon) offers better performance than ML-DSA but has implementation challenges, especially for secure signing, and is not yet widely available.
- Proof-of-knowledge schemes like FAEST, MQOM, and SDitH provide conservative security and flexibility for applications like anonymous credentials, but may not outperform ML-DSA dramatically.
- Structured multivariate schemes like MAYO and SNOVA aim to reduce key sizes, with MAYO being more conservative and SNOVA more aggressive but less stable.
- Timelines for new signature algorithms suggest they won't be ready in time for initial migrations (e.g., FN-DSA by 2033, multivariate by 2034), so ML-DSA is necessary for now.
- The ongoing competition is crucial for advancing post-quantum cryptography beyond basic primitives, enabling future improvements and applications like anonymous credentials.
Bugs happen: The easy way to compare solo PQ to ECC+PQ
2 months ago
- ECC+PQ (hybrid) is recommended over solo PQ because solo PQ will lead to many exploitable software vulnerabilities, causing immediate security disasters.
- ML-KEM and ML-DSA implementations have already had numerous bugs and timing leaks (e.g., KyberSlash1, KyberSlash2), and more vulnerabilities are expected as they are newer and less tested than ECC software.
- Even if PQ specifications remain unbroken, software flaws in PQ libraries will expose keys, whereas an ECC layer can rescue users by delaying attacks and limiting damage.
- Quantum attacks will be expensive and limited in scale initially, so ECC provides additional protection by delaying attacks until quantum computers are available and affordable.
- The cost of adding ECC to PQ is negligible compared to PQ's own costs (e.g., X25519 adds only 32 bytes to ML-KEM's 800+ bytes), and deployment examples (like Cloudflare) show ECC+PQ is already working without delays.
- Proponents of solo PQ use flawed arguments, such as overstating complexity or costs, and ignore the value of ECC in mitigating software vulnerabilities and delaying quantum attacks.
Show HN: Grade your code's post-quantum crypto exposure A–F, free, in-browser
2 months ago
- A Cryptographic Bill of Materials (CBOM) is crucial for identifying quantum-vulnerable cryptography in your stack as part of PQC migration.
- An open-source scanner provides a full scan in CI/CD workflows, generating a CycloneDX 1.6 CBOM, SARIF report, and an A–F grade badge without uploading data.
- The scan can be run locally via npm or integrated into GitHub Actions, with options to fail builds on broken classical cryptography.
- For audit readiness, an Evidence Pack Express offers a cryptographically signed deliverable including an executive summary, findings, CBOM, and migration plan.
- Note: The scanner is lexical, findings are leads to verify, not a complete inventory, and it does not guarantee quantum safety or certification.
Shipping post-quantum cryptography to Python – The Trail of Bits Blog
2 months ago
- pyca/cryptography version 48 now supports post-quantum algorithms ML-KEM and ML-DSA, funded by the Sovereign Tech Agency.
- Post-quantum cryptography addresses threats from quantum computers, with U.S. government migration deadlines set for 2030-2031.
- ML-DSA signatures and ML-KEM key exchange have larger data sizes than classical algorithms (e.g., Ed25519, X25519).
- SLH-DSA, a hash-based signature standard, is not yet supported but is under development for future updates.
- Protocol integration and application adoption are needed for a complete migration to post-quantum cryptography in Python.

post-quantum cryptography

RFC 9851: TLS 1.2 is in Feature Freeze

NIST Develops New Standards to Safeguard Computers Against Quantum Threats

Some thoughts about Anthropic's new cryptanalysis results

Post-quantum public-key encryption: what’s it all about?

Classical Acceptance Is Not Hybrid Authentication: Measuring X.509 Verifier

France's Anssi Will Block PQC-Free Products from Certification Starting 2027

We cannot wait for better post-quantum signature algorithms

Bugs happen: The easy way to compare solo PQ to ECC+PQ

Show HN: Grade your code's post-quantum crypto exposure A–F, free, in-browser

Shipping post-quantum cryptography to Python – The Trail of Bits Blog