QSL—data at rest
A method to allow a client to communicate with a server, specifically to conduct a key management service, in order to obtain encryption/decryption keys for data-at-rest, wherein the method comprises: causing the client to use Authenticated Encryption with Associated Data (AEAD) to encrypt data according to a moving target design and causing the client, at a later time, to use AEAD to check the integrity of the data and decrypt the data according to the moving target design.
1 . A method to allow a client to communicate with a server, specifically to conduct a key management service, in order to obtain encryption/decryption keys for data-at-rest, wherein the method comprises: causing the client to use Authenticated Encryption with Associated Data (AEAD) to encrypt data according to a moving target design; and
causing the client, at a later time, to use AEAD to check the integrity of the data and decrypt the data according to the moving target design, wherein the method further comprising: using a symmetric encryption algorithm with the bits-of-security reduced to one half of the classical value to provide at least 128 bits-of-security against a quantum attacker.
2 . The method according to claim 1 , wherein the method further comprising: using a hashing algorithm with the bits-of-security reduced to one half of the classical value to provide at least 128 bits-of-security against a quantum attacker.
3 . The method according to claim 1 , wherein the symmetrical encryption algorithm is a post-quantum symmetric encryption block cipher.
4 . The method according to claim 3 , wherein the post-quantum symmetric encryption block cipher outputs an EVP CIPHER initialized to aes_256_ctr.
5 . The method according to claim 3 , wherein the post-quantum symmetric encryption block cipher outputs an EVP CIPHER initialized to aes_256_gcm.
6 . A system comprising:
at least one processor, at least one computer-readable memory, and at least one computer-readable, tangible storage device wherein:
the at least one processor communicates with at least one outside processor to allow a client to communicate with a server, specifically to conduct a key management service, in order to obtain encryption/decryption keys for data-at-rest, wherein the system comprises:
a client computing device is configured to:
cause the client to use Authenticated Encryption with Associated Data (AEAD) to encrypt data according to a moving target design; and
cause the client, at a later time, to use AEAD to check the integrity of the data and decrypt the data according to the moving target design, wherein the client computing device is configured to:
use a symmetric encryption algorithm with the bits-of-security reduced to one half of the classical value to provide at least 128 bits-of-security against a quantum attacker.
7 . The system according to claim 6 , wherein the client computing device is configured to: use a hashing algorithm with the bits-of-security reduced to one half of the classical value to provide at least 128 bits-of-security against a quantum attacker.
8 . The system according to claim 6 , wherein the symmetrical encryption algorithm is a post-quantum symmetric encryption block cipher.
9 . The system according to claim 8 , wherein the post-quantum symmetric encryption block cipher outputs an EVP CIPHER initialized to aes_256_ctr.
10 . The system according to claim 8 , wherein the post-quantum symmetric encryption block cipher outputs an EVP CIPHER initialized to aes_256_gcm.