The demand for computational resources in the rapidly changing field of cybersecurity is dramatically increasing. Our current systems of cryptography are based on the assumption that an adversary can’t work out certain mathematical problems in a reasonable amount of time. But what if the bad guys had at their disposal something that could do those calculations in a truly parallel way? To put it another way, could something like a quantum computer, with its tremendous power and speed, challenge our traditional systems of encryption?
Quantum computing devices have shown the ability to vastly accelerate certain computations, making many current cryptographic primitives practically broken. We have come up with a quantum-safe VPN solution that is robust, scalable and modular that would be resilient against threats in the post-quantum era long before this crisis was on our radars.
The Need for a Quantum-Safe Solution
A huge part of the current communication security standard is the techniques of asymmetric encryption (RSA, Diffie-Hellman, ECC (Elliptic curve encryption), etc. Digital signatures and key exchange mechanisms used in TLS and VPN protocols depend on these algorithms. However, these cryptographic systems are vulnerable to attacks as Shor’s algorithm is able to break them when executed on a sufficiently powerful quantum computer.
This vulnerability is not just theoretical. As published quantum systems continue to advance and well funded nation-state actors are actively cooperating to advance them, rapid development in quantum computing is a foregone conclusion. The timeline until we have capable quantum computers remains unclear, and the “harvest now, decrypt later” threat model adds to the urgency. Today, it’s possible for an adversary to capture encrypted data and hoard it until quantum computers are powerful enough to extract the original data. As this may well threaten private information of long-term value, immediate action is called for to prevent this.
The need for a quantum-safe VPN solution is particularly pressing for industries handling highly sensitive data, such as finance, healthcare, government, defence and critical infrastructure. A secure communication channel immune to quantum attacks is paramount to ensure confidentiality, integrity, and availability in a post-quantum world.
The Genesis of Our Solution
Our journey began with a simple yet ambitious question: How can we design a VPN solution that remains secure even in the face of quantum computing advancements? To answer this, we established the following guiding principles:
1. Future-Proof Security: The solution must incorporate post-quantum cryptography (PQC) algorithms approved or recommended by leading cryptographic standards bodies, such as NIST standardized algorithms, ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS205).
2. Flexibility and Adaptability: The system should be modular, allowing for seamless integration of new cryptographic algorithms as they evolve. For example, this includes incorporating algorithms still under evaluation in future rounds, as well as accommodating recommendations and changes to already standardized algorithms.
3. Scalability: The solution must support diverse deployment scenarios, from individual devices (even small devices like IoT devices with very limited resources) to enterprise-scale networks.
4. Robustness: The VPN must provide reliable performance while maintaining strong security guarantees, even under attack or high-load conditions.
Developing the Core of the Quantum-Safe VPN Solution
To achieve these objectives, we adopted a systematic approach to designing and implementing the core of our quantum-safe VPN solution:
- Post-Quantum Cryptographic Algorithms
The first step was to identify suitable PQC algorithms. We were following the NIST Post-Quantum Cryptography Standardization process closely, adopting algorithms based on finalist and alternate candidate pools, including Kyber, Dilithium and others. With the conclusion of the Round-4 of the standardization, we immediately moved to use ML-KEM, ML-DSA and SLH-DSA so that our solution is in line with cutting edge of Quantum-Safe algorithms. These algorithms are:
- ML-KEM: A lattice-based key encapsulation mechanism (KEM) for secure key exchange.
- ML-DSA: A lattice-based digital signature scheme providing robust authentication.
- SLH-DSA: A stateless hash-based signature scheme for long-term security.
We ultimately ensured that, by integrating these algorithms and hybrid cryptographic algorithm support, i.e. bringing together post quantum algorithms and classic crypto mechanisms to improve crypto agility, into the VPN’s crypto suite, the system would withstand both classical and quantum attacks and provide a path to smoother transition to quantum-proof solutions.
2. Modular Architecture
We designed QSleeve as a modular architecture to promote flexibility and adaptability. By separating the cryptographic engine from the protocol and application layers, the architecture enables developers to:
• Swap cryptographic algorithms without altering the core VPN functionality.
• Customize the VPN for specific use cases or compliance requirements.
• Extend the solution beyond VPN applications to secure other communication channels, such as IoT networks or secure messaging platforms.
3. Performance Considerations Post-quantum algorithms often have larger key sizes and higher computational requirements compared to classical algorithms. To mitigate performance impacts, we:
• Utilized hybrid cryptographic approaches, combining PQC algorithms with classical counterparts for transitional security.
• Conducted extensive benchmarking to identify and address performance bottlenecks.
4. Scalability and Deployment To support diverse deployment scenarios, we designed the solution to be:
• Device-Agnostic: Compatible with a wide range of devices, from resource-constrained IoT devices to high-performance servers.
• Network-Aware: Capable of operating efficiently in varying network conditions, including low-bandwidth and high-latency environments.
• Cloud-Ready: Easily deployable in cloud environments including support for major cloud service providers, ensuring organizations with a diverse and hybrid infrastructure can transition smoothly to our solution.
Beyond VPN: A Versatile Security Framework
While the initial goal was to create a quantum-safe VPN, we discovered the basic solution’s broader utility. The system’s modular design and strong cryptographic base make it adaptable to different security applications, such as:
• Secure IoT Communication: Protecting IoT devices and networks from quantum threats.
• Encrypted Messaging: Ensuring the confidentiality and authenticity of messages in communication platforms.
• Data Protection: Safeguarding stored data with quantum-resistant encryption.
• Financial transactions: The solution can be applied to financial transactional communication scenarios, such as those in payment networks or financial systems, where secure, real-time communication is critical.
• Secure Critical Infrastructure: Ensuring the protection of power grids, water systems, and other essential services against potential quantum-enabled cyberattacks.
• Military and Defence Communications: Providing quantum-resistant encryption for secure communication and data exchange in defence and intelligence operations.
The concept for our solution has matured, and it has also been patented (“QUANTUM-RESISTANT CRYPTOGRAPHIC SYSTEM FOR SECURE COMMINCATION”). This demonstrates our expertise and drive to develop a solution that can protect the future of this interconnected world against quantum dangers.
Conclusion
The quantum computing era requires a proactive approach to cybersecurity. Our quantum-safe VPN solution is an important step toward protecting sensitive conversations and data from quantum threats. We created a dynamic security framework that can adapt to a variety of applications and growing threats by adding post-quantum cryptography, adopting a modular and scalable architecture, and optimizing performance.
As quantum computing advances, our commitment to cybersecurity innovation and collaboration must also evolve. Staying ahead of the curve ensures that tomorrow’s digital infrastructure is secure, resilient, and trustworthy.
