2020 - Christian Paquin - Stay quantum safe: future-proofing encrypted secrets

### Overview In this presentation, Christian Paquin, a cryptography specialist at Microsoft Research (MSR), discusses the emerging threat quantum computers pose to modern cryptography and outlines practical steps organizations can take immediately to future-proof encrypted communications. Although scalable quantum computing may still be a decade or more away, Paquin emphasizes the urgent need for action due to "harvest now, decrypt later" attacks on long-lived data, prolonged standardization cycles, and the complex engineering required to update legacy infrastructure.

### Key Topics - **Quantum Threat Model:** Peter Shor's 1994 algorithm threatens public-key cryptography by breaking factorization and discrete logarithm problems underlying RSA, ECDSA, and Diffie-Hellman (including elliptic-curve variants). Conversely, Grover's algorithm affects symmetric primitives (e.g., AES, hash functions) in a non-catastrophic manner that can be mitigated by doubling key/primitive sizes. - **Timing and Urgency:** While quantum hardware capable of running Shor's algorithm on real-world cryptosystems may require millions of physical qubits and a technological breakthrough (such as topological qubits), adversaries can capture encrypted network traffic today and decrypt it once a cryptographically relevant quantum computer becomes available. - **NIST Post-Quantum Cryptography Standardization:** NIST initiated a competition in 2017 to standardize quantum-resistant algorithms, narrowing 69 proposals to 26 in Round 2, with Round 3 announcements and eventual draft standards expected in subsequent years. - **The Open Quantum Safe (OQS) Project:** An open-source, multi-organization effort led by the University of Waterloo that integrates post-quantum algorithms into standard cryptographic libraries and network protocols (including forks of OpenSSL, BoringSSL, OpenSSH, and OpenVPN, as well as wrappers for C++, C#, Go, Java, and Python).

### Technical Details - **Hybrid Key Exchange:** Because new post-quantum algorithms lack decades of cryptanalysis, Paquin advocates combining a classical algorithm (such as ECDHE) with a post-quantum algorithm (such as SIKE or Frodo) into a combined key derivation process. The derived symmetric key remains secure as long as at least one of the underlying algorithms remains unbroken. To avoid protocol changes in TLS 1.3 and SSH, OQS implemented "combo algorithms" that appear as single negotiation schemes to the protocol layer. - **Protocol Integration Constraints:** Due to larger public key and signature sizes in many post-quantum schemes, modifications were required in OpenSSL and OpenSSH to accommodate larger buffer structures. While most schemes (e.g., Frodo, qTESLA, Picnic 2) could be integrated into TLS 1.3 and SSH, certain algorithms with very large artifacts (e.g., NTS-KEM, Rainbow in SSH, or Picnic 1 at higher security levels) encountered fit limitations. - **Benchmarking & Network Performance:** - *Network Emulation:* Using the Linux kernel network emulator (`netem`) with `openssl s_time` and NGINX, researchers found that on reliable networks, hybrid key exchange performed comparably to pure ECDHE. Under packet loss rates exceeding 5%, algorithms with larger public keys suffered latency degradation due to packet fragmentation and retransmission. - *Real-World WAN Simulation:* Testing across geographically dispersed virtual machines with webpage sizes ranging from 1 KB to 1 MB showed that the relative overhead of hybrid key exchange and post-quantum certificates amortizes significantly over distance and larger payload transfers. - **Post-Quantum Tunneling via OpenVPN:** To protect legacy systems or IoT devices without modifying client code, Paquin demonstrated tunneling communications over an OpenSSL-backed post-quantum OpenVPN tunnel. This approach was field-tested over long durations connecting Microsoft's Redmond headquarters to Project Natick—an experimental underwater data center located off the coast of Scotland in the North Sea.

### Takeaways Security practitioners must prioritize asymmetric encryption and key exchange systems over digital signatures, because retroactive decryption of recorded communications poses an active, present-day threat. By leveraging hybrid deployment models and post-quantum tunnels, organizations can achieve quantum safety today with acceptable real-world performance overhead while formal standards are finalized.