3 ms·

Yes, the rest of the cryptography needs to be PQ-secure as well. But that's largely already true: The key exchange is now typically done with X25519MLKEM768,

Yes, the rest of the cryptography needs to be PQ-secure as well. But that's largely already true: The key exchange is now typically done with X25519MLKEM768, a hybrid of the traditional x25519 and ML-KEM-768, which is post-quantum secure. The exchanged keys typically AES-128 or AES-256 or ChaCha20. These are likely to be much more secure against quantum computers as well (while they may be weakened, it is likely we have plenty of security margin left). Changing the key exchange or transport encryption protocols however is much, much easier, as it's negotiated and we can add new options right away. Certificates are the trickiest piece to change and upgrade, so even though Q-day is likely years away still, we need to start working on this now. Upgrading the key exchange has already happened because of the risk of capture-now, decrypt-later attacks, where you sniff traffic now and break it in the future.

itopaloglu83 1y ago
> Changing the key exchange or transport encryption protocols however is much, much easier, as it's negotiated and we can add new options right away. So that’s a good point. We can quickly add new encryption protocols after the point things are negotiated in the connection, but adding something new or entirely replacing the certificate system or even just the underlying protocols is a big deal.
jcgl 1y ago
> The key exchange is now typically done with X25519MLKEM768, a hybrid of the traditional x25519 and ML-KEM-768, which is post-quantum secure. How "typical" are you suggesting this is? Honestly, it's the first I'd heard of this being done at all in the wild (not that I'm an expert). Peeking around a smattering of random websites in my browser, I'm not seeing it mentioned at all.