F5 Labs explainer: quantum computing threatens RSA/ECC and 'harvest now, decrypt later' drives post-quantum migration
This F5 Labs explainer describes how quantum computing affects cryptography. Shor's algorithm can efficiently break the problems behind RSA, DSA, Diffie-Hellman and ECC, while Grover's algorithm only halves the effective strength of symmetric ciphers such as AES. The article stresses "harvest now, decrypt later" risk: an adversary who records encrypted traffic today could decrypt it once a capable quantum computer exists. It cites current estimates that about 1 million noisy qubits could break RSA-2048 in under a week (down from 20 million in a 2017 estimate), with a machine expected roughly a decade away. NIST recommends deprecating vulnerable protocols by 2030 and eliminating them by 2035. No incident, exploitation or threat actor is described.
Technical Details
- Shor's algorithm gives exponential speedup against factoring and discrete logarithms, and increasing key size does not meaningfully hinder it.
- Grover's algorithm gives a quadratic speedup on brute force. AES-128 drops to about 64-bit effective strength, while AES-256 (about 128-bit) is considered safe.
- Quantum key distribution (BB84) is described as quantum cryptography, distinct from quantum cryptanalysis.
- Post-quantum cryptography (PQC) uses algorithms resistant to both classical and quantum attacks. Lattice-based schemes are the most promising for key exchange.
- In TLS 1.3, hybrid key exchange pairs a classical algorithm with a quantum-resistant one. X25519MLKEM768 (X25519 ECDH plus NIST-approved ML-KEM) was by far the most common hybrid in F5's survey of the top one million sites.
- Apache and Nginx support PQC key exchange, as do CDNs such as Cloudflare and Fastly. IoT, legacy OS and browsers, and non-upgradable devices will be left behind.
Remediation
- Move to post-quantum/quantum-resistant cryptography everywhere cryptography is used.
- Assess exposure to harvest-now-decrypt-later and act accordingly (change passwords, expire keys).
- Migrate from TLS 1.2 or earlier to TLS 1.3, and consider CDNs to gain PQC capability immediately.
- Plan to protect the most valuable long-lived data with PQC within the next 4-5 years.
Linha do tempo
-
F5 Labs explainer: quantum computing threatens RSA/ECC and 'harvest now, decrypt later' drives post-quantum migration
ler a análise desta fonte ocultar
This F5 Labs explainer describes how quantum computing affects cryptography. Shor's algorithm can efficiently break the problems behind RSA, DSA, Diffie-Hellman and ECC, while Grover's algorithm only halves the effective strength of symmetric ciphers such as AES. The article stresses "harvest now, decrypt later" risk: an adversary who records encrypted traffic today could decrypt it once a capable quantum computer exists. It cites current estimates that about 1 million noisy qubits could break RSA-2048 in under a week (down from 20 million in a 2017 estimate), with a machine expected roughly a decade away. NIST recommends deprecating vulnerable protocols by 2030 and eliminating them by 2035. No incident, exploitation or threat actor is described.
Technical Details
- Shor's algorithm gives exponential speedup against factoring and discrete logarithms, and increasing key size does not meaningfully hinder it.
- Grover's algorithm gives a quadratic speedup on brute force. AES-128 drops to about 64-bit effective strength, while AES-256 (about 128-bit) is considered safe.
- Quantum key distribution (BB84) is described as quantum cryptography, distinct from quantum cryptanalysis.
- Post-quantum cryptography (PQC) uses algorithms resistant to both classical and quantum attacks. Lattice-based schemes are the most promising for key exchange.
- In TLS 1.3, hybrid key exchange pairs a classical algorithm with a quantum-resistant one. X25519MLKEM768 (X25519 ECDH plus NIST-approved ML-KEM) was by far the most common hybrid in F5's survey of the top one million sites.
- Apache and Nginx support PQC key exchange, as do CDNs such as Cloudflare and Fastly. IoT, legacy OS and browsers, and non-upgradable devices will be left behind.
Remediation
- Move to post-quantum/quantum-resistant cryptography everywhere cryptography is used.
- Assess exposure to harvest-now-decrypt-later and act accordingly (change passwords, expire keys).
- Migrate from TLS 1.2 or earlier to TLS 1.3, and consider CDNs to gain PQC capability immediately.
- Plan to protect the most valuable long-lived data with PQC within the next 4-5 years.