Adaptive qubit-based threshold handshaking for quantum safe protocols
In one embodiment, a first device in a network receives a quantum computing power metric indicative of a maximum available compute power of quantum computers. The first device receives, from a second device in the network, a listing of cryptographic suites available on the second device. The first device selects, based on the quantum computing power metric, a particular cryptographic suite from among the listing of cryptographic suites available on the second device. The first device sends, to the second device via the network, an indication that the particular cryptographic suite is to be used to encrypt and decrypt traffic exchanged between the first device and the second device.
1. A method comprising:
receiving, at a first device in a network, a quantum computing power metric indicative of a maximum available compute power of quantum computers;
receiving, at the first device and from a second device in the network, a listing of cryptographic suites available on the second device;
selecting, by the first device and based on the quantum computing power metric, a particular cryptographic suite from among the listing of cryptographic suites available on the second device; and
sending, by the first device and to the second device via the network, an indication that the particular cryptographic suite is to be used to encrypt and decrypt traffic exchanged between the first device and the second device.
2. The method as in claim 1 , further comprising:
caching, by the first device, an association between the second device and the particular cryptographic suite for use in a future traffic session.
3. The method as in claim 1 , further comprising:
forming, by the first device, encrypted traffic by encrypting at least a portion of the traffic using the particular cryptographic suite; and
transmitting, by the first device, the encrypted traffic to the second device via the network, wherein the second device uses the particular cryptographic suite to decrypt the encrypted traffic based in part on the indication sent by the first device.
4. The method as in claim 1 , wherein the maximum available compute power of quantum computers comprises a maximum qubit volume usable by any quantum computer currently available.
5. The method as in claim 1 , wherein the maximum available compute power of quantum computers comprises a maximum number of qubits usable by any quantum computer currently available.
6. The method as in claim 1 , wherein each of the listing of cryptographic suites has an associated quantum computing power threshold above which that cryptographic suite is considered vulnerable to malicious decryption.
7. The method as in claim 6 , wherein selecting the particular cryptographic suite comprises:
comparing the associated quantum computing power threshold of each of the listing of cryptographic suites to the quantum computing power metric received by the first device.
8. The method as in claim 1 , wherein the first device receives the quantum computing power metric via a secure connection with a remote service.
9. The method as in claim 1 , wherein the first device selects the particular cryptographic suite based in part on an amount of time that contents of the traffic is considered to be confidential.
10. The method as in claim 1 , wherein the first device and the second device comprise network routers.
11. An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
receive a quantum computing power metric indicative of a maximum available compute power of quantum computers;
receiving, from a remote device in a network, a listing of cryptographic suites available on the remote device;
select, based on the quantum computing power metric, a particular cryptographic suite from among the listing of cryptographic suites available on the remote device; and
send, to the remote device via the network, an indication that the particular cryptographic suite is to be used to encrypt and decrypt traffic exchanged between the apparatus and the remote device.
12. The apparatus as in claim 11 , wherein the process when executed is further configured to:
cache an association between the remote device and the particular cryptographic suite for use in a future traffic session.
13. The apparatus as in claim 11 , wherein the process when executed is further configured to:
form encrypted traffic by encrypting at least a portion of the traffic using the particular cryptographic suite; and
transmit the encrypted traffic to the remote device via the network, wherein the remote device uses the particular cryptographic suite to decrypt the encrypted traffic based in part on the indication sent by the apparatus.
14. The apparatus as in claim 11 , wherein the maximum available compute power of quantum computers comprises a maximum qubit volume usable by any quantum computer currently available.
15. The apparatus as in claim 11 , wherein the maximum available compute power of quantum computers comprises a maximum number of qubits usable by any quantum computer currently available.
16. The apparatus as in claim 11 , wherein each of the listing of cryptographic suites has an associated quantum computing power threshold above which that cryptographic suite is considered vulnerable to malicious decryption.
17. The apparatus as in claim 16 , wherein the apparatus selects the particular cryptographic suite by:
comparing the associated quantum computing power threshold of each of the listing of cryptographic suites to the quantum computing power metric received by the apparatus.
18. The apparatus as in claim 11 , wherein the apparatus receives the quantum computing power metric via a secure connection with a remote service.
19. The apparatus as in claim 11 , wherein the apparatus selects the particular cryptographic suite based in part on an amount of time that contents of the traffic is considered to be confidential.
20. A tangible, non-transitory, computer-readable medium storing program instructions that cause a first device in a network to execute a process comprising:
receiving, at the first device in the network, a quantum computing power metric indicative of a maximum available compute power of quantum computers;
receiving, at the first device and from a second device in the network, a listing of cryptographic suites available on the second device;
selecting, by the first device and based on the quantum computing power metric, a particular cryptographic suite from among the listing of cryptographic suites available on the second device; and
sending, by the first device and to the second device via the network, an indication that the particular cryptographic suite is to be used to encrypt and decrypt traffic exchanged between the first device and the second device.