Full Report
The NCSC publishes its recommendations for configuring post-quantum cryptography in TLS. Now is time to migrate.
Analysis Summary
# Best Practices: Post-Quantum Cryptography (PQC) Migration for TLS
## Overview
These practices address the urgent need to transition Transport Layer Security (TLS) configurations to include Post-Quantum Cryptography. This migration aims to protect encrypted data from "harvest now, decrypt later" attacks, where adversaries collect encrypted traffic today to decrypt it once cryptographically relevant quantum computers (CRQCs) become available.
## Key Recommendations
### Immediate Actions
1. **Inventory Cryptographic Usage:** Identify where TLS is used within your infrastructure and which versions/libraries are currently in place.
2. **Verify TLS 1.3 Support:** Ensure your systems are running TLS 1.3, as the recommended PQC key exchange mechanisms are specifically designed for this version.
3. **Monitor Vendor Roadmaps:** Check with your OS, browser, and cloud service providers for their timelines on supporting the **X25519MLKEM768** hybrid key exchange.
### Short-term Improvements (1-3 months)
1. **Enable Hybrid Key Exchange:** Configure supported servers and clients to use the hybrid **X25519MLKEM768** algorithm. This combines classical (X25519) and post-quantum (ML-KEM) methods, ensuring security even if one method is later found vulnerable.
2. **Update Crypto Libraries:** Upgrade OpenSSL, BoringSSL, or equivalent libraries to versions that support the final NIST-standardized version of ML-KEM (formerly Kyber).
3. **Testing in Sandbox:** Deploy PQC-enabled TLS in non-production environments to identify potential performance overheads or handshake failures.
### Long-term Strategy (3+ months)
1. **Phased Decommissioning:** Establish a timeline to phase out "classical-only" key exchanges for high-sensitivity data.
2. **Authentication Migration:** Prepare for the next phase of PQC, which will involve migrating digital signatures and certificates (Authentication) once NCSC and NIST finalize specific TLS profile recommendations.
3. **Agility Policy:** Implement "Cryptographic Agility" protocols to allow for rapid updates to algorithms as PQC standards evolve.
## Implementation Guidance
### For Small Organizations
- **Prioritize Defaults:** Rely on managed services (CloudFlare, AWS, Azure, Google Cloud) that enable PQC by default at the edge.
- **Browser Updates:** Ensure all corporate devices run the latest versions of mainstream browsers (Chrome, Edge, Firefox), which are already enabling PQC hybrid key exchange.
### For Medium Organizations
- **Internal Infrastructure:** Audit internal applications and APIs. Update internal load balancers and reverse proxies (e.g., NGINX, HAProxy) to support hybrid PQC ciphers.
- **VPN Transition:** Inquire with VPN vendors about their transition plans to PQC-protected tunnels.
### For Large Enterprises
- **Discovery Deployment:** Use network scanning tools to find "shadow" TLS implementations that may not support new standards.
- **Priority Segmenting:** Focus PQC deployment first on links carrying high-value data with a long "shelf-life" (data that remains sensitive for 10+ years).
- **Capacity Planning:** Hybrid handshakes are slightly larger; monitor network latency and CPU utilization on high-traffic gateways.
## Configuration Examples
*Note: Recommendations are based on NCSC guidance for the standardized ML-KEM/X25519 hybrid.*
**Naming Convention to look for in Config Files:**
- `X25519MLKEM768` (Standardized)
- `X25519Kyber768Draft00` (Potential legacy/draft naming)
**Preferred TLS 1.3 Groups:**
text
# Priority Order for Key Exchange Groups
X25519MLKEM768 : X25519 : secp384r1
## Compliance Alignment
- **NIST FIPS 203:** Standard for ML-KEM (the underlying PQC algorithm).
- **NCSC TLS Guidance:** Aligns with the UK government's recommended profiles for protecting data in transit.
- **RFC 9106 / Relevant IETF Drafts:** Ensuring interoperability of hybrid key exchanges in TLS 1.3.
## Common Pitfalls to Avoid
- **PQC-Only Implementation:** Do not switch to PQC-only key exchange yet. Always use a **hybrid** approach to maintain a "safety net" of classical cryptography.
- **Ignoring Legacy Clients:** Ensure that enabling PQC does not inadvertently block older, business-critical clients that do not yet understand the new key exchange identifiers.
- **Waiting for Certificates:** Do not wait for PQC certificates to start migrating. You can—and should—implement PQC Key Exchange while still using classical RSA/ECDSA certificates.
## Resources
- **NCSC Guidance:** [https://www.ncsc.gov.uk/guidance/using-tls-to-protect-data]
- **NIST PQC Project:** [https://csrc.nist.gov/projects/post-quantum-cryptography]
- **PQC Migration Workshop Reports:** [Available via NCSC.gov.uk]