Post Quantum Cryptography Report

Quantum Safe Algorithm Standards

After a multi-year selection process, in 2022 the US National Institute of Standards and Technology (NIST) has selected four post-quantum algorithms for standardization [1]. Three of the standards came out in 2024, with FN-DSA expected to be approved in 2026 [2].

Most selected standards are lattice-based, with SLH-DSA serving as a stateless hash-based alternative for increased cryptographic diversity.

Other notable key encapsulation algorithms include HQC [3], which has been chosen by NIST as a backup key encapsulation algorithm, and Classic McEliece, which made it to the final stage of selection. In its Commercial National Security Algorithm Suite 2.0, the NSA recommends using ML-KEM-1024 and ML-DSA-87 [4].

Rust implementations of post-quantum algorithms:

• Implementations of ML-KEM for use in TLS are provided by aws-lc-rs, which is a rust binding of the Amazon-backed AWS-LC cryptographic library.
• Pure rust implementations maintained by the RustCrypto group: ml-kem, ml-dsa, slh-dsa.
• Crates from the pqcrypto family are popular, but the PQClean project they are based on is scheduled for archiving.

Current Threats

Most of the focus from agencies like CISA, NSA, and NIST has been on the threat of "harvest now, decrypt later" (HNDL) attacks [5]. In these attacks, an adversary intercepts and stores current communication to decrypt it later once cryptographically relevant quantum computers (CRQC) become available. While there have been no confirmed HNDL attacks, incidents where traffic was deliberately routed through adversarial networks suggest that sophisticated state actors are currently engaged in collection efforts [6].

Quantum Computing Advancements

While current quantum computers are far from being able to break classical encryption—with the highest number factored using Shor's algorithm remaining at 21 [7]—recent years have seen advancement in quantum computing regarding error correction [8] and architectural efficiency [9]. The current record for number of qubits stands at 6100 physical qubits by Caltech [10] and 48 logical qubits by Quantinuum [11]. In their roadmap, IBM announced it plans to build a 2000 logical qubit quantum computer by 2033+ [12].

This is combined with algorithmic advancements, such as the recent result by Google Quantum AI researcher Craig Gidney that has lowered the estimated number of physical qubits needed to break RSA-2048 from 20 million to less than 1 million [13]. This corresponds to around 1399 logical qubits, suggesting IBM's planned 2000 qubit quantum computer could be capable of breaking RSA-2048.

According to a recent survey, many experts believe that a CRQC may be built as early as the 2030s [14]. This aligns with multiple government guidelines which recommend a transition to post-quantum cryptography by 2030–2035 [15].

TLS

The industry is transitioning to hybrid key exchange, combining classical algorithms like X25519 with quantum-safe ML-KEM. Hybrid key exchange standards like X25519MLKEM768 are supported by most major browsers and libraries like OpenSSL, BoringSSL, and AWS-LC.

For gRPC with Tonic, consider using rustls with aws-lc-rs as the cryptographic backend.

The TLS configuration should enforce:

• version 1.3, which features built-in protection from downgrade attacks,

• hybrid key exchange, e.g. X25519MLKEM768,

• strong symmetric encryption, e.g. TLS_AES_256_GCM_SHA384.

In the realm of quantum-safe certificates, progress is slower due to the complexity of public key infrastructure. Some PKI providers are exploring dual/hybrid certificate models.

WireGuard

The cryptographic primitives used in the WireGuard protocol are not quantum-safe. By design, it provides little cryptographic agility, which makes its implementation shorter compared to previous protocols. It does however provide the option to use a 256-bit pre-shared key (PSK). The PSK is generated before the WireGuard connection and is hashed into the chaining key after the Diffie-Hellman operations have taken place.

Assuming the PSK has been established via post-quantum cryptography, this approach provides a layer of confidentiality, as it protects communication from being decrypted in a HNDL attack. The classic Curve25519 public and private keys are still used to provide authentication and identity rather than being the sole source of confidentiality. As they are not quantum-safe, a potential attacker can retrospectively identify who was connected while not being able to decrypt the communication.

There are two primary approaches for establishing the PSK:

• Using a custom protocol using existing key encapsulation mechanisms. This is the method used by Mullvad [16], which establishes a temporary WireGuard tunnel to negotiate a PSK using ML-KEM and HQC.

• Generating the PSK as a cryptographically secure random string provided to peers through quantum-protected tunnels. The official wg configuration tool provides a wg genpsk command for this purpose. Because TLS with PQC is used elsewhere, this is the simplest solution. This approach is used by ExpressVPN [17]. In the case of a centralized authority, identity exposure risk can be alleviated by generating new ephemeral client keys for each connection and sending them to the gateway through the core service.

JWT

The current scheme with short-lived JWT access tokens and one-time-use revocable refresh tokens is safe as long as best practices are followed.

The only quantum vulnerability is with the algorithms used to sign access tokens, which become vulnerable once cryptographically relevant quantum computers arrive. None of the standardized JWT signing algorithms are quantum-safe. Standards for quantum-safe signing are currently being drafted, but it is possible to provide custom alg headers and enforce them in your issuer and verifier.

One choice for quantum-safe signing is ML-DSA, possibly in hybrid mode with standard signing algorithms. The problem is signature size, which ranges from 3 KB to 4.5 KB depending on the variant used. On the web, this prevents tokens from fitting in standard cookies, requiring the use of the Backend-for-Frontend pattern or storing tokens in memory.

As they do not pose an active threat, it is recommended to use current standards and wait for post-quantum JWT signature standardization to switch.

Conclusions

To combat the current threat of HNDL attacks and prepare for a full transition to post-quantum cryptography, it is recommended to:

• Use TLS 1.3 with hybrid key exchange and strong symmetric encryption.

• Configure WireGuard to use random pre-shared keys and ephemeral client keys transported over TLS.

• Use standard JWT signing methods today, with a plan to upgrade to post-quantum signatures once standards are finalized.

References

[1] NIST Announces First Four Quantum-Resistant Cryptographic Algorithms: https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms

[2] FIPS 206 (Draft): FN-DSA (Falcon) Status Update: https://csrc.nist.gov/csrc/media/presentations/2025/fips-206-fn-dsa-%28falcon%29/images-media/fips_206-perlner_2.1.pdf

[3] NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption: https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption

[4] NSA Commercial National Security Algorithm Suite 2.0 FAQ: https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF

[5] CISA, NSA, and NIST: Quantum Readiness Guide: https://www.cisa.gov/sites/default/files/2023-08/Quantum%20Readiness_Final_CLEAR_508c%20%283%29.pdf

[6] Military Cyber Affairs: BGP Hijacking and State Actors: https://digitalcommons.usf.edu/mca/vol3/iss1/7/

[7] U. Skosana and M. Tame, "Demonstration of Shor’s factoring algorithm for N=21 on IBM quantum processors," arXiv:2103.13855: https://arxiv.org/abs/2103.13855

[8] Microsoft and Quantinuum: Advancing Science on Reliable Logical Qubits: https://blogs.microsoft.com/blog/2024/04/03/advancing-science-microsoft-and-quantinuum-demonstrate-the-most-reliable-logical-qubits-on-record-with-an-error-rate-800x-better-than-physical-qubits/

[9] Post-Quantum: Quantum Computing Companies and IBM Roadmap: https://postquantum.com/quantum-computing-companies/ibm/

[10] Caltech: Caltech Team Sets Record with 6,100-Qubit Array: https://www.caltech.edu/about/news/caltech-team-sets-record-with-6100-qubit-array

[11] Quantinuum: Introducing Helios - The Most Accurate Quantum Computer in the World: https://www.quantinuum.com/blog/introducing-helios-the-most-accurate-quantum-computer-in-the-world

[12] IBM: IBM Quantum Roadmap: https://www.ibm.com/roadmaps/quantum/

[13] C. Gidney, "Lower bounds on the physical qubit requirements of RSA-2048," arXiv:2505.15917: https://arxiv.org/pdf/2505.15917

[14] Global Risk Institute: 2024 Quantum Threat Timeline Report: https://globalriskinstitute.org/publication/2024-quantum-threat-timeline-report/

[15] PQShield: PQC Transition Roadmaps and Guidance: https://pqshield.com/pqc-transition-roadmaps-and-guidance/

[16] Mullvad VPN App Architecture: https://github.com/mullvad/mullvadvpn-app/blob/main/docs/architecture.md?plain=1#L195

[17] ExpressVPN: Post-Quantum WireGuard: https://engrxiv.org/preprint/view/5020