Why Hybrid Cryptography is Best Practice for Quantum Migration

The looming threat of quantum computers running Shor's algorithm is driving many organizations to enact quantum migration plans. However, this doesn't mean that companies should replace classical algorithms (RSA, ECDSA, etc.), with their post-quantum counterparts (ML-KEM, etc.).

Instead, organizations are recommended to adopt hybrid cryptography, which pairs a classical algorithm with a post-quantum one. This approach is designed to address a couple of different failure modes.

Why Hybrid Cryptography?

Post-quantum cryptographic algorithms are designed to address the threat that quantum computing poses to asymmetric cryptography. Shor's algorithm, which can be run on a sufficiently large quantum computer, completely breaks these algorithms because it provides a more efficient solution to the "hard" problems that they're based on. By making these problems solvable in polynomial time, Shor's algorithm renders the cryptography that relies on them insecure.

Hybrid cryptography is recommended over a direct swap over to post-quantum algorithms. The reason for this is that the post-quantum algorithms standardized today (ML-KEM, etc.) aren't trusted as strongly as traditional, asymmetric cryptography.

Algorithms like RSA, AES, and others in common use today have undergone decades of cryptanalysis. Since no major flaws or attacks have been discovered, there is a high level of trust in their security (until quantum computers come along).

ML-KEM and other standardized post-quantum algorithms haven't had those decades of analysis, making it possible that an attack might be discovered in the near future. For example, SIKE, a Round 4 candidate in NIST's contest for standardizing post-quantum algorithms, could be broken in an hour on a laptop.

If organizations make a full transition to a post-quantum algorithm that is later broken, then all the data that it protects is at risk. Hybrid cryptography balances the risk since the classical algorithm will provide protection if the post-quantum algorithm is broken. At the same time, the post-quantum algorithm (if secure), manages the risk of harvest now, decrypt later attacks targeting the classical algorithm.

Implications of a Hybrid Approach to Quantum Migration

Hybrid cryptography is best practice for quantum migration from a security and interoperability perspective. Classical and post-quantum algorithms protect against each other's flaws, and software needs to use the same algorithm sets as the other applications that they're communicating with. For example, TLS, Google Chrome, and Cloudflare have already adopted X25519 + ML-KEM for hybrid key exchange.

However, this approach to addressing quantum risk does have its downsides. Some of the most significant include:

• Larger Keys/Signatures: Post-quantum algorithms already use larger public keys and digital signatures than their classical counterparts. Using both algorithms together exacerbates this issue, requiring additional data storage and network bandwidth for common operations.
• Decreased Performance: Similarly, post-quantum algorithms are slower than classical algorithms. The need to run both algorithms further increases computational requirements, runtime, and latency.
• Secondary Migration: Hybrid cryptography makes sense because it balances the theoretical risk of a broken post-quantum algorithm against the certainty that classical algorithms will be broken in the future. Once cryptographically-relevant quantum computers (CRQCs) become available, hybrid cryptography provides no real benefit over post-quantum algorithms alone, requiring another migration.

Making the Switch to Hybrid Cryptography

Hybrid cryptography is best practice for a quantum migration because it addresses the risks that post-quantum algorithms are flawed and that classical algorithms will be broken in the future by quantum computers. In combination, they offer key exchange and digital signatures that are highly likely to be secure.

While many possible combinations exist, many organizations have already started adopting certain sets, such as X25519+ML-KEM. Implementing these standardized combos is best practice both for security and interoperability.

Educational content, not legal, financial, investment, or professional security advice. Terms