Quantum-Safe HTTPS: Improving Web Latency with NIST PQC Standards
- [01] Quantum computing threatens existing encryption, allowing adversaries to capture and decrypt encrypted traffic once quantum-scale hardware becomes available to state actors.
- [02] Web infrastructure relying on RSA and Elliptic Curve Cryptography is susceptible to harvest now decrypt later strategies targeting sensitive long-term data.
- [03] Organizations must inventory cryptographic assets and evaluate browsers supporting NIST standards like ML-KEM to prepare for post-quantum transitions.
As the industry prepares for the potential arrival of cryptographically relevant quantum computers, major web infrastructure providers are prototyping new methods to secure the web without sacrificing performance. According to Dark Reading, these providers are testing a quantum-safe version of HTTPS that significantly reduces the size of digital certificates, potentially making the web both faster and more resilient to future threats. This transition is centered on the adoption of the recently finalized National Institute of Standards and Technology (NIST) standards for post-quantum cryptography (PQC).
The Technical Shift to Post-Quantum Standards
The move toward PQC is driven by the threat that quantum computers will eventually be able to break the mathematical foundations of current public-key encryption, specifically RSA and Elliptic Curve Cryptography. To counter this, NIST has standardized algorithms such as ML-KEM (formerly Kyber) for key encapsulation and ML-DSA (formerly Dilithium) for digital signatures. While these algorithms provide security against quantum-enabled APT groups, they often involve larger key and signature sizes, which can increase the overhead of the TLS handshake.
To address this latency, researchers are exploring techniques to shrink the certificate chain. By utilizing hash-based signatures and leveraging certificate transparency logs, developers can reduce the volume of data sent during a handshake to approximately a tenth of its previous size. This optimization is vital for maintaining performance in a Zero Trust architecture, where encrypted connections are frequently established and verified. Implementing a post-quantum cryptography implementation roadmap now allows organizations to test how these larger packets interact with existing middleboxes and network appliances, which may incorrectly flag non-standard traffic as an IoC.
Mitigating Harvest Now Decrypt Later Attacks
The primary driver for immediate action is the threat of “harvest now, decrypt later” (HNDL) attacks. In this scenario, adversaries capture current encrypted traffic and store it until quantum technology matures enough to perform decryption. By mitigating harvest now decrypt later attacks through the early adoption of PQC-ready browsers and servers, organizations can ensure that data stolen today remains protected in the future. This approach aligns with MITRE ATT&CK defenses aimed at long-term data exfiltration protection. While no specific CVE has been assigned to the absence of PQC, the systemic risk to global encryption protocols is considered a high-priority architectural concern for federal and enterprise SOC teams.
Post-Quantum Cryptography Implementation Roadmap
Transitioning to a quantum-resistant posture requires more than just a software update. Security professionals must follow a structured NIST post-quantum encryption standards migration plan to ensure compatibility across diverse environments. This begins with discovery—identifying every system that relies on legacy public-key algorithms for authentication or data privacy.
Recommended Actions for Defenders
- Cryptographic Inventory: Catalog all instances of RSA and ECC within the environment, prioritizing internet-facing services and high-value data repositories.
- Browser and Library Updates: Ensure that web browsers and TLS libraries are updated to versions that support ML-KEM and X25519MLKEM768 hybrid key exchange.
- Network Compatibility Testing: Monitor for network disruption during the transition, as some firewalls and load balancers may struggle with the increased size of post-quantum TLS handshakes.
- Vendor Verification: Consult with cloud and security vendors regarding their timelines for supporting NIST-approved PQC algorithms in their managed services.
Advertisement