ETSI’s Technical Committee Cyber Security (TC Cyber) has published a Technical Report, TR 103 617, on Quantum-Safe Virtual Private Networks.
The report explores protocol requirements necessary to add quantum resistance to VPN technologies, including client, server and architectural considerations. Specifically, requirements around protocols and key establishment are considered based on the multitude of systems that are at risk and require security updates before quantum computers that can attack commercial cryptography are developed. Having explored a number of the requirements and potential solutions to get VPN infrastructures ready for quantum-safety, the report concludes that the transition will be extremely complex and organizations should start migration planning early in order to minimize costs and disruption to their business.
The deployment of Virtual Private Networks is a common choice for governments and enterprises to securely communicate between their sites or to connect employees with offices. VPNs are not only likely to be vulnerable to compromise by quantum computers in the future but data transmitted today with longer term confidentiality requirements is also at risk from harvesting and decryption at a future date. Consequently, a hybrid approach to security, combining quantum safe and classic key establishment techniques is recommended, said ETSI.
The Technical Report considers general VPN requirements, in particular the need to maintain the properties offered by existing classical handshakes while adding protection from quantum computers. While quantum computing threatens both confidentiality and authentication, the report focuses on the confidentiality aspect as this is considered a higher priority risk due to the immediate threat of an attack that harvests data now for decryption at a later date. The report looks in turn at the underlying security protocols by which a VPN achieves cryptographic security. These include Internet Protocol Security (IPSec) and Internet Key Exchange (IKE); Transport Layer Security (TLS); Media Access Control Security (MACsec); and Secure Shell (SSH). For each protocol, it discusses the background, hybrid requirements and solutions, and direct drop-in requirements.
Mark Pecen, Chair of ETSI's Working Group Quantum-Safe Crytography
ETSI has been working on quantum-safe cryptography for more than 3 years now to offer the market efficient and timely solutions for the future. Because of recent advances, the quantum computer presents a serious challenge to widely used current cryptographic techniques and assumptions.
