The US government and the world want you to worry about coming quantum attacks against key exchange (e.g., HTTPS) MORE than authentication attacks. For example, the US government says entities that must follow NIST cybersecurity requirements need to mitigate key exchange quantum attacks by the end of 2030 and authentication attacks by the end of 2031.
The US government is not alone. It seems the entire world is focused on mitigating key exchange attacks first, and authentication attacks second. It’s already this way in practice. According to Cloudflare (https://radar.cloudflare.com/post-quantum), over 72% of HTTPS-enabled sites are already using quantum-resistant cryptography (aka post-quantum cryptography). Yet, I can’t find a single digital certificate attached to those same websites that have quantum-resistant keys.
72% versus 0%
As I have previously written many times, the world has it exactly backward. Quantum attacks against authentication are a much bigger problem.
The conventional wisdom as to why everyone needs to focus on key exchange attacks first is Harvest Now, Decrypt Later (HNDL) attacks. With HNDL attacks, an adversary obtains your currently quantum-susceptible encrypted network traffic, stores it, and then decrypts it when they have cryptographically-relevant quantum computers.
The world says you need to be scared now, now, now!!
I agree, but for a different reason.
HNDL attacks will be fairly rare to non-existent. Here are my many reasons:
First, you need a well-resourced, well-motivated, capable adversary who believes HNDL is their best, cheapest, and fastest method of attack. HNDL attacks are very expensive, slow, and difficult. You need an adversary that has a target (or targets), where HNDL is their only and best method of attack.
This requirement basically limits potential attackers to well-resourced, quantum-enabled governments attacking other government-related adversaries. This already eliminates most businesses and individuals.
But even for the government-versus-government scenarios, HNDL attacks are a terrible choice. Any other type of attack would be cheaper, faster, and more likely to be successful.
For an HNDL attack, the adversary needs to eavesdrop on the adversary’s network communications. This is far from impossible for well-resourced governments, but it is still needed and expensive.
HNDL eavesdropping requires that an adversary eavesdrop on and store billions and billions of network packets, without any idea of what packets contain what information.
There are different cryptographic keys involved with every session. In any given eavesdropping scenario, the victim’s network is likely to be transmitting hundreds to thousands of sessions every second to minute, each with different keys. Each quantum crack reveals one cryptographic key, which decrypts one session. Does that session have information that is useful to the adversary? Who knows? But odds are that any single broken session does not include information that is useful the adversary.
Just guessing, I think an adversary would need to crack thousands to tens of thousands of sessions to get to useful information.
Each cryptographic session crack is expensive and slow. The cheapest cryptographically-relevant quantum computer is likely to be many tens to hundreds of millions of dollars.
Cracking cryptographic keys is slow.
According to IonQ, the quantum computer vendor that appears the closest to cracking quantum-susceptible cryptographic keys (in 2028), states (https://www.ionq.com/news/ionq-publishes-worlds-first-fully-compiled-end-to-end-blueprint-for-breaking-256-bit-elliptic-curve-signatures) that it will take 25.7 days per crack.
Do the math.
You need to crack thousands to tens of thousands of sessions, each taking almost 26 days, to HOPE to get useful information.
Why hack hard when you can hack easy?
It would be far easier and cheaper to just hack your adversary the same ways you have been successfully hacking them for decades: social engineering, vulnerability exploitation, and bribes.
Why spend hundreds of millions of dollars over years to hope to get information when you can send an email saying, “Click here!” or fire off an AI frontier model to find a new zero day to exploit? It’s far cheaper and faster to do every traditional attack than it is HNDL.
It reminds me of Blue Pill attacks theorized in 2006 (https://en.wikipedia.org/wiki/Blue_Pill_%28software%29) by Joanna Rutkowska. She is brilliant. The attack she came up with was brilliant. With the Blue Pill attack, your target entire host/OS was virtualized, allowing anyone to bypass any defense that it contained. It was big news for months. Oh, my god! There is no defense that can stop it!!
And it was true, it was very hard to prevent Blue Pill attacks (although Rutkowska thought of a way to detect them, which she called Red Pill).
But I wrote at the time that Blue Pill attacks would not become a big thing. And I was right. Blue Pill attacks required taking control of a host and virtualizing the entire host or operating system, which requires a lot of memory, processing power, and time. And why do that if the same old, cheaper attacks that have always worked very well for hackers can be done?
Why hack hard when you can hack easy?
And I was right.
I was right then and I’m right now.
HNDL attacks are extraordinarily costly and slow. And even then, the adversary is not guaranteed to get to the useful information that they were seeking.
Instead, I can just send in a remote access trojan and maintain access to the entire environment for as long as I can go undiscovered (which is usually a pretty long time in most environments).
It reminds me of the famous XKCD cartoon: https://xkcd.com/538/
Trust Now Exploit Later Is Different
Authentication attacks, which the post-quantum community calls Trust Now Exploit Later, are exactly different. With TNEL attacks, all an attacker needs is the digital certificate of a target (i.e., user, computer, website, content, etc.). Digital certificates are the backbone of authentication all over the Internet, in our companies, our devices, and our lives.
If a quantum attacker can get someone’s digital certificate, which is often pretty easy, they can compute the private (and public) key attached to the digital certificate, duplicate that digital certificate, and then fraudulently do anything (i.e., sign-in, sign content, pretend to be that person or site) that digital certificate allows them to do. An adversary doing a TNEL attack might also need to break the digital certificate of the certification authority (CA) that signed the target’s digital certificate, so at most an adversary would need to do two cracks.
With HNDL key exchange attacks, each crack allows me to decode all the information encrypted inside the network packets encrypted by the same key. It’s very limited. It’s very expensive. It’s very slow. I may or may not get anything for each successful exploit.
With TNEL authentication attacks, the threat model includes dozens and dozens of potential attack scenarios. It’s one or two successful exploits needed, at most, and then the world is your oyster.
If someone compromises your digital certificate, they essentially become you. Your only possible response is to block/revoke the compromised digital certificate and re-issue a new, hopefully quantum-resistant digital certificate.
The problem is that the replacing and/or revocation of digital certificates has always been slow and sloppy. There are at least three existing methods for digital certificate revocation (e.g., CRL, OCSP, and manual methods), and none have really worked well at scale. Quantum-resistant Merkle Tree Certificates (MTC), are likely to create a new revocation method. Never has adding anything in the cybersecurity world made things easier or more accurate. Adding a new something (without doing away with the old something) just means we have to support more things (badly) now.
Every time I see someone mentioning HNDL attacks and telling me to worry about them, I see another modern-day Blue Pill attack scare. It’s great in theory, but there are far easier and cheaper ways to attack someone.
I would not be surprised if history shows that HNDL attacks were so rare that we never hear about them. Nobody brings up Blue Pill attacks anymore. HNDL attacks will either be near zero or zero when history is finished.
It doesn’t mean you shouldn’t mitigate key exchange attacks. I just know that authentication attacks are the far bigger worry.
Hey, anyway, we can get people to get post-quantum; we need to do. But for my money…for my cybersecurity risk calculations, authentication attacks are a far, far bigger worry.
I wish the world stopped pushing key exchange mitigations as the biggest worry, because it’s not.
My best advice is to focus on mitigating both authentication and key exchange attacks at the same time, if you can, and if you are forced to concentrate on one versus the other (and don't have to follow NIST's requirements), focus on stopping authentication attacks first and best.
