Post-quantum TLS

Short answer: Post-quantum TLS today mostly means hybrid key exchange, which combines a classical algorithm and a post-quantum one so the connection stays secure if either holds. RFC 9954, an informational RFC, describes how to do this in TLS 1.3 but does not choose the post-quantum algorithm. Providers such as Cloudflare say they have deployed hybrid key exchange, yet not every connection is protected this way.

Structural Approaches to Hybrid Key Exchange

A primary strategy for securing TLS against future quantum threats is the implementation of hybrid key exchange. This approach involves using multiple key exchange algorithms simultaneously and combining their results. The goal is to provide security even if a method is found to defeat the encryption for all but one of the component algorithms. This design philosophy is motivated directly by the transition to post-quantum cryptography, where confidence in any single new algorithm may be limited.

RFC 9954 provides a specific construction for hybrid key exchange in TLS version 1.3. The overall design approach described in this document is a simple "concatenation" method. By concatenating the outputs of different key exchange mechanisms, the protocol ensures that the final shared secret depends on the success of multiple independent cryptographic operations. It is important to note that this document does not propose specific post-quantum mechanisms itself. Instead, it defines the framework within which various post-quantum algorithms can be integrated. This separation of concerns allows the protocol to remain flexible as new post-quantum standards emerge and are vetted by the cryptographic community. The hybrid model thus acts as a bridge, allowing the gradual introduction of post-quantum components without requiring an immediate, wholesale replacement of existing classical mechanisms.

Vulnerabilities of Classical Asymmetric Cryptography

The urgency of adopting post-quantum measures stems from the known vulnerabilities of the asymmetric cryptography currently used in TLS. The Transport Layer Security protocol is one of the most widely used security protocols in the world, protecting information exchanged between web clients and servers. However, while TLS is secure against today’s classical computers, its asymmetric components are vulnerable to future attacks from quantum computers.

Both RSA and Elliptic Curve Diffie-Hellman, the algorithms that set up the TLS exchange, will succumb to Shor’s algorithm on a sufficiently large quantum computer. This theoretical vulnerability exists regardless of the current state of quantum hardware. Estimates of when a quantum computer of the necessary size and stability will exist vary, and cryptographers are already working on solutions. The risk is not only that a quantum computer will break a connection in real-time, but also that data encrypted today could be decrypted in the future if it is stored long enough. This scenario is often referred to as a "harvest-now, decrypt-later" attack. Because TLS protects a vast amount of global communication, the potential exposure of historical data to such attacks underscores the need for proactive protocol updates. The existence of a theoretical break does not mean an immediate operational failure, but it does necessitate a planned transition to algorithms that are resistant to quantum-based attacks.

Operational Considerations and Deployment Timelines

As the theoretical foundations for post-quantum security are established, organizations are beginning to consider operational timelines for deployment. According to its own documentation, Cloudflare, for instance, has been researching and writing about post-quantum cryptography since 2017. They have set a target of 2029 to be fully post-quantum secure across their entire product suite. This timeline reflects a cautious approach that balances the need for security with the practical challenges of updating global infrastructure.

To protect against the risk of harvest-now, decrypt-later attacks, and considering the volume of connections that take place when a website or application is on a platform like Cloudflare, the organization has deployed and is actively expanding the use of post-quantum hybrid key exchange. This indicates that the transition is not purely academic; it is being integrated into real-world infrastructure. However, it is crucial to distinguish between the deployment of hybrid mechanisms and the full adoption of post-quantum-only standards. Hybrid approaches allow for a gradual rollout, where classical and post-quantum algorithms operate in tandem. This mitigates the risk of implementation errors in new post-quantum code while still providing a layer of future-proofing. The expansion of these hybrid techniques suggests that the industry is moving from research-stage proposals toward operational integration, albeit in a phased manner.

Scope and Limitations of Current Standards

While the direction of travel is clear, the current standards and documentation have specific scopes that must be understood. RFC 9954, for example, focuses on the construction of hybrid key exchange in TLS 1.3 but explicitly does not propose specific post-quantum mechanisms. This means that the standard provides the "how" of combining algorithms, but not the "what" of the specific post-quantum primitives to be used. Users and implementers must look to other sources for the specific post-quantum algorithms that are compatible with this hybrid framework.

Furthermore, the sources reviewed suggest that most use cases are still in the research or early deployment stage. While organizations like Cloudflare are targeting full post-quantum security by 2029, the current state of affairs involves a mix of classical and post-quantum techniques. It is incorrect to assume that post-quantum TLS is universally available or that all connections are already protected by post-quantum algorithms. The transition is ongoing, and the hybrid model serves as a critical interim solution. Researchers have proposed and shown in simulation the viability of these hybrid approaches, but operational adoption is still expanding. Therefore, any claim that post-quantum security is fully realized across the internet would be premature. The focus remains on the careful, phased integration of these new cryptographic primitives into existing protocols, ensuring that the transition does not disrupt the widespread reliance on TLS for secure communication.

FAQ

What is hybrid key exchange in TLS?

It uses more than one key exchange algorithm at once and combines the results, so the final secret stays safe as long as at least one component algorithm holds. RFC 9954 describes a simple concatenation approach for TLS 1.3.

Does RFC 9954 pick the post-quantum algorithm?

No. It defines the framework for combining algorithms but does not propose specific post-quantum mechanisms. Implementers need other documents for those. It is published for information and is not an Internet Standards Track specification.

Why is TLS exposed to quantum computers?

TLS protects traffic between web clients and servers, but the RSA and elliptic curve Diffie-Hellman algorithms that set up the exchange would be broken by Shor's algorithm on a sufficiently large quantum computer. Data captured today could be decrypted later.

Is post-quantum TLS already in use?

According to Cloudflare's own documentation, it has deployed and is expanding post-quantum hybrid key exchange, and it is targeting 2029 to be fully post-quantum secure across its product suite. That is one provider's statement, and not all connections are protected this way.

Are all connections protected against quantum attacks now?

No. The current situation is a mix of classical and post-quantum techniques, and the hybrid model is an interim measure.