Last summer saw security giant Palo Alto Networks update its firewall operating system with quantum-optimized hardware to deliver high‑throughput processing of post-quantum cryptography (PQC). The heart of the update was a quantum readiness dashboard promised to provide Palo Alto Networks operating system (PAN-OS) users a full end-to-end view of what has and hasn’t yet been upgraded to quantum readiness.

For Palo Alto Networks, the crux is that most endpoint devices, cloud applications, and browsers can already support quantum-safe algorithms, meaning enterprises need to only make them active for quantum readiness. The more pressing problem concerns legacy applications, with the firm estimating that around 3,000 internally developed legacy applications will need post-quantum support once "Q-Day" rolls around and a quantum computer becomes powerful enough to break encryption.

“That's a multi-year project for most organizations. So that's piece No. 1 across the organization in providing this assessment without any new infrastructure to deploy,” Palo Alto Networks SVP Rich Campagna told SDxCentral at the time.

The discussion of quantum-proofing legacy applications is causing some excitement in the world of cryptography, spurred by the National Institute of Standards and Technology (NIST)’s 2035 deadline for foundational public-key cryptography system RSA (Rivest-Shamir-Adleman) to be phased out and the transition to PQC to be complete.

Martin Albrecht, professor of cybersecurity and chair of cryptography at King's College London, noted an opportunity to thus “rip out” cryptographic architecture approaching three decades in age.

“In the 90s, early 2000s, we knew a lot less about how to build secure systems back then than we do now,” Albrecht said. “So the implementations that you get for post-quantum often come with much stronger assurances in terms of ruling out certain classes of software bugs. I think that's really an opportunity for building better systems.”

To aid quantum upgrade for legacy apps, Palo Alto Networks introduced a cipher translation proxy, which can automatically convert classical traffic into NIST-approved post-quantum algorithms, the sort also deployed last year in various Fortinet and F5 solutions.

Peter Scheffler, senior solutions architect at F5, explained that as PQC standards are evolving and have only recently been ratified, this means many applications and application servers are not capable of providing the security recommended by NIST guidelines.

“Having a proxy in front of the application that supports these allows for a scalable and manageable solution to mitigate Q-Day,” Scheffler explained. “Further, as the standards evolve, having a single place to manage the necessary changes minimizes the operational overhead required to build new executables or deploy new services.”

“The way it works is you take an application, or set of applications, and isolate them behind a firewall so they have no connectivity to anything other than the firewall itself,” Campagna said of Palo Alto Network’s system. “Those applications talk classical – not quantum safe – crypto to our firewalls, and then in the firewall, in real time, we translate that to quantum-safe encryption so that the entirety of the outside world beyond this isolated segment sees this as quantum-safe cryptography.”

Apart from using a cipher translation proxy, there is the option of adding a new security layer, such as a VPN or zero-trust protocol, which gathers application traffic end‑to‑end through a post-quantum protected channel without necessarily inspecting or translating the app‑level protocol. This means endpoints inside the tunnel may still speak classical crypto to each other, like with the proxy method.

Bas Westerbaan, principal research engineer at Cloudflare, understands the appeal of such solutions, especially to organizations that do not know where cryptography is used in their framework, and who provided the software in business – a vendor that may not even still be in business.

But Westerbaan warned that proxies and tunnels may be Band-Aids rather than a proper remedy, “as you can't tunnel everything. And if you upgrade by a tunnel, you need to control both of its ends.”

Legacy reckoning

The ultimate solution, Westerbaan argued, is to rip and replace, echoing Albrecht. But another discussion doing the rounds in the cryptography space is how those new, better systems should be built: either by using hybrid PQC or pure, standalone PQC algorithms.

The former method includes the examples cited above, which see a combination of a classical and post-quantum algorithm used together. The latter, meanwhile, utilizes a post-quantum signature and/or encryption primitive with no classical component, with security reliant on mathematically vetted lattice and/or hash-based constructions.

One key difference between the two is bloat. As F5 explained, the keys are larger and the math is different.

“This can mean your servers need more space to store the keys, your bandwidth will be impacted since more data will flow between the client and server and, finally, there is more compute needed to encrypt and decrypt the conversation,” Scheffler said.

Pure systems can ‘collapse’

F5 is encouraging a mix of both classical and post-quantum methods in the so-called TLS handshake, where transport layer security (TLS) 1.3 encrypts internet traffic and enables clients and servers to share SSL certificates.

“This is as we don't know if these will be secure in the future,” Scheffler explained. “PQC has been tested, but it's new. Think of hybrid PQC like wearing both a seatbelt and an airbag. By combining traditional methods with post-quantum algorithms in the same handshake, systems get two layers of protection: the proven security of what we use today, plus the quantum-resistant layer that protects against tomorrow’s threats.”

“We cannot trust PQC algorithms 100% yet because they haven't stood the test of time like RSA or ECC (elliptic curve cryptography),” Min-Ho Jung, CTO of PQC firm HSKG Lab, noted, highlighting the PQC baseline algorithm CRYSTALS-Kyber, warning that “if a mathematical flaw is found in Kyber tomorrow, pure PQC systems would collapse.”

Scheffler revealed F5 customers are typically looking for hybrid key establishment, primarily with module lattice-based key-encapsulation mechanism (ML-KEM) FIPS 203 for TLS 1.3. ML-KEM is the official NIST name for Kyber, standardized by NIST as FIPS 203.

The TLS equivalent for networks is IPsec/IKEv2, which is where everyday and quantum-safe firewalls operate. Axel Poschmann, VP of product at PQShield, explained TLS 1.3 and IKEv2/ IPsec are the most widely deployed transports at the network and transport layers and thus the first to get robust hybrid PQC profiles.

“That’s why gateway products start there: you get the broadest risk reduction with the least app change,” Poschmann added, referring to modifying the application itself in order to support new security or protocol features.

Hybrid hurry

In the hybrid debate, it’s also worth noting startups such as HSKG Lab are tackling the hybrid heft issue. Jung claimed its IceKey solution derives a key from multiple sources, such as biometrics and device sensors, and stores neither classical nor PQC keys, thus saving on memory.

“We generate the hybrid key pair (ECC + Kyber) instantly from the user's ‘bio-spatial-time’ variables and vaporize them immediately after the handshake," Jung explained. "This allows you to carry the ‘heavy shield’ of hybrid PQC without feeling its weight, because we only materialize the shield for the nanosecond it is needed.”

Cloudflare, meanwhile, is working with Google to shrink hybrid PQC in Chrome to avoid what Westerbaan termed as “breakages on the browser level.”

But experts SDxCentral talked to agreed that with Q-Day approaching, enterprises can’t debate the pros and cons of hybrid versus pure PQC nor wait for new solutions to become standardized. Instead, they must start now with hybrid as the default and speediest route.

While Jason Soroko, senior fellow at Sectigo, concedes current proxies do not provide end‑to‑end quantum resilience, it’s fine as long as companies “plan for crypto agility so you can swap algorithms as standards mature.”

“As we start the journey with an abundance of legacy systems, hybrid approaches will be an appropriate option to move forward," Soroko said.

“The world’s technology supply chain needs to be quantum-proof by 2035, in line with guidelines from NIST, NCSC, and more,” Poschmann added. “To meet this deadline, organizations need to think risk-first and time-to-impact. Most organizations don’t need every protocol upgraded on day one; they need a phased, highest-value rollout. Over-engineering every protocol on day one can slow you down and blow budgets. The real ‘overkill’ is doing nothing until every app is ready. The pragmatic approach is to deploy PQ at the perimeter now for the data that matters, then iterate protocol-by-protocol as native stacks harden.”

Poschmann recommended the first step companies need to take is to protect long-lived confidential data, which is most susceptible to harvest-now, decrypt-later attacks, in which threat actors steal encrypted data in the here and now with the intention to wait for post-Q-Day decryption technologies capable of breaking current cryptography methods.

This first means understanding the shelf life of your data, and then upgrading external links that carry sensitive data and using hybrid PQC solutions at gateways.

F5’s Scheffler referred to the concept of data horizon, which is how long the data is relevant or critical.

“Some data is ephemeral and expires in moments, like a banking transaction," Scheffler said. "This data horizon is important when assessing where to protect the data you have stewardship of and how you should protect it.”

Once your data is prioritized, Poschmann recommended carrying out a cryptographic inventory of where one’s data is flowing (TLS, IPsec, et al.) and which apps and partners are on that path.

“Then, secure high-value internal links (such as data center to cloud connectors, or service-mesh ingress points) and plan app-native upgrades to ensure native PQC across your app stacks," Poschmann said.

Echoing Cloudflare’s Westerbaan, Poschmann warned quantum-proofing a legacy app does not magically modernize the app itself. Enterprises will still need a plan to modernize application stacks over time.

“Quantum-proofing can be part of your overall modernization process, as it will be for all organizations over the next 10 years," Poschmann added.

In other words, whether Q-Day comes in 10 or 20 years, businesses will have to become quantum-proof by 2035 regardless of the technology’s development.

This article first appeared in the SDxCentral Quantum Supplement

Read the full Supplement. Simply register.