2
$\begingroup$

Are there any cryptographic protocols available for HTTP such as TLS or QUIC with practical or near-practical quantum computer resistance?

$\endgroup$
1
  • 1
    $\begingroup$ Can you define what is practical in real metrics? $\endgroup$
    – kelalaka
    Commented Apr 27 at 19:54

1 Answer 1

4
$\begingroup$

There have been tests performed using OpenSSL with PQC algorithms including the two winners of the NIST PQC competition CRYSTALS-Kyber and CRYSTALS-Dilithium, see for instance the page for the oqs provider. These tests were mainly performed to test how feasible PQC is, as there have not been any agreed upon standards to my knowledge; the referenced RFC are still in the draft stage.

If you're going to implement it you would need:

  • two sides that are using the same (currently unrecognized) standards, which in this early stage probably means that you need to use the same software configuration on both sides;
  • a PKI based on PQC, i.e. quantum safe certificates; these can be build using OpenSSL or EJBCA, but it means that you have to control and secure all of the PKI - sending a certificate with a PQC to a commercial CA is unlikely to succeed after all.

Now the main issue with quantum computers is store-and-decrypt, where an adversary stores your conversations to later attack the asymmetric key exchange. This is still possible even if forward security is being used.

So if you don't want to roll out your own you could use generic certificates and only quantum-protect the key establishment with CRYSTALS-Kyber. This would ignore the issue that an authentication private key may have been compromised, but that's less of an issue with the current state of quantum-computers.

So I'd say yes, you can create a practical HTTP connection over a secure protocol such as TLS, but:

  • it hasn't been officially standardized;
  • there is no existing PKI infrastructure;
  • you're relying on proof-of-concept code;
  • hardware support is in its infancy.

Other than that it is up to you what you call "practical". I'd call running code that provides confidentiality against quantum computers "practical", but beware of things like side channel attacks and practical security such as buffer overruns, key destruction etcetera.

If you decide to go this way it would probably be a good idea to use a TLS configuration that uses hybrid scheme (e.g. ECDHE + Kyber).


Note that I've referenced Open Source software for which I know that there is a lot of support and which have been fore-runners in practical PQC testing. This is however not a personal endorsement of said software nor it is likely to be the only software available that has protection against quantum-cryptanalysis.

$\endgroup$
4
  • 2
    $\begingroup$ I'd also point out that Chrome already uses by default Kyber+X25519 hybrid for key exchange. Therefore, if you are connecting to servers that support it, such as Cloudflare or Google, you are already safe (modulo future stuff like eprint 2024/555) against harvest now, decrypt later :), but of course not against active MITM quantum attackers since the authentication is still classical. blog.chromium.org/2023/08/… $\endgroup$
    – honzaik
    Commented Apr 29 at 15:09
  • $\begingroup$ Interesting. Do you know if there is a Google specific library used for that or is it simply integrated into Chrome / Chromium? $\endgroup$
    – Maarten Bodewes
    Commented Apr 29 at 15:51
  • 2
    $\begingroup$ I think Chromium/Chrome uses github.com/google/boringssl and it seems they implemented it on their own github.com/google/boringssl/commit/… github.com/… But for a fact (I tested it myself) I know it is compatible with OQS's OpenSSL fork. I tried it with Apache Tomcat (which can use OpenSSL) and it works. So it should be just as easy to integrate it into Apache/NGINX etc. Of course, it is still experimental. $\endgroup$
    – honzaik
    Commented Apr 29 at 16:09
  • $\begingroup$ Great. I'm not entirely sure that I'm happy with them skipping the standardization process, but Google has had a big influence in testing the protocols and it is more secure, so I'm not complaining too hard about that, especially since I'm sure they will upgrade the protocol if the standards do deviate from what is out there. Uh, that's my way of praising them I guess :P $\endgroup$
    – Maarten Bodewes
    Commented Apr 29 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.