Threat model and security aspects of post-quantum cryptography.

The Scenario:

1. Attackers intercept encrypted data today
2. Store it for years/decades
3. Decrypt it with a future quantum computer

Affected Algorithms:

• RSA (all key lengths)
• ECDSA / ECDH (all curves)
• DSA

Timeline:

• Estimates: 10-20 years until cryptographically relevant quantum computers
• BSI¹⁾: Migration recommended by 2030

Hybrid cryptography provides:

• Backward compatibility: Legacy systems can validate classical signature
• Future security: PQ signature protects against quantum attacks
• Security margin: Secure if at least one algorithm is secure

Hybrid Certificate:
+-- RSA-4096 Signature (classical)
+-- ML-DSA-65 Signature (PQ, in X.509 extension)

Validation:
+-- Legacy client: Verifies only RSA [check]
+-- Modern client: Verifies RSA + ML-DSA [check][check]

• Use CryptoMode.Hybrid as default
• Validate both signatures when possible
• Never hardcode private keys
• Use using statements for crypto objects
• Set OpenSSL path once at startup

• Keep OpenSSL 3.6+ updated
• Backup PQ key store (%LOCALAPPDATA%\WvdS.Crypto\PqKeys\)
• Plan certificate renewal before expiry
• Set up monitoring for validation errors

• Plan migration now (not when quantum computers are available)
• Prioritize long-term data (contracts, health data, state secrets)
• Hybrid certificates for all new systems

• Risk - Business perspective
• Compliance - NIST conformance
• Operations - Operational measures

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional