What Is PQC?

Why Do We Need PQC?

In the digital era, data security underpins both enterprise security and personal privacy. Traditional cryptographic algorithms rely on complex mathematical problems to ensure data security. However, the rapid advancement of quantum computing poses an unprecedented threat to the security of these traditional algorithms.

Impact of Quantum Computing on Cryptographic Systems

Quantum computing technologies leverage quantum superposition and entanglement to achieve parallel computing, posing a fundamental threat to traditional cryptographic systems.

• Asymmetric cryptographic algorithms: Their security depends on specific mathematical problems, such as integer factorization and discrete logarithms. These problems are computationally infeasible on classical computers—cracking 2048-bit RSA would take hundreds of millions of years—which is why we have long considered them secure. However, Shor's factoring algorithm, proposed by Peter Shor in 1994, shattered this assumption. This algorithm reduces the complexity of solving integer factorization and discrete logarithm problems from the exponential level (on classical computers) to the polynomial level, thereby breaking these mathematical problems with ease.
• Symmetric cryptographic algorithms: Their security depends on the difficulty of searching the key space. Quantum computers can use Grover's algorithm to try all possible keys at a significantly faster rate, effectively halving the key search space (equivalent to halving the effective key length).

This means that once a sufficiently powerful quantum computer is available, keys that would normally take years or even longer to crack could be broken in days or even hours.

In summary, quantum computing halves the security strength of symmetric encryption and compromises the security of asymmetric encryption.

Realistic Threat

While quantum computers could theoretically break asymmetric keys in a short time, the full threat has not yet materialized due to current hardware limitations. However, there is a "Harvest Now, Decrypt Later" risk in cyber security. Attackers can obtain and store encrypted data in advance, waiting for quantum computing technology to mature before decrypting it. This type of latent attack poses a significant threat to data requiring long-term confidentiality, such as financial data.

Common PQC Algorithms

PQC refers to public-key cryptographic algorithms that run on classical computers and are designed to resist attacks from quantum computers. Its primary objective is to maintain data confidentiality, integrity, and identity authentication in the quantum computing era—particularly after the widespread adoption of Shor's and Grover's algorithms.

Currently, PQC has five main algorithm types, each with its own characteristics. The following table summarizes the key points for each type of algorithm.

PQC offers provable security, meaning its security can be mathematically proven. As long as the underlying mathematical problem cannot be efficiently solved, the algorithm is considered secure. However, it is important to note that "provable security" is not equivalent to "absolute security." The proof relies on the assumption that the mathematical problem itself cannot be solved. History has already seen precedents where PQC algorithms (such as Rainbow and SIKE) were cracked. This indicates that while PQC's security is based on mathematical proofs, it is not absolutely infallible.

PQC builds security defense based on hard mathematical problems, providing the first line of defense for quantum-safe migration. Its biggest advantage is easy deployment. It can be quickly implemented on the existing network infrastructure through pure software upgrades, without the need for new hardware or optical fibers.

Typical Application Scenarios of PQC

Application of PQC in an SD-WAN Scenario

In the SD-WAN EVPN scenario depicted in the following figure, each CPE establishes a DTLS tunnel with the RR to create a management channel for information exchange between the CPE and RR. This tunnel facilitates subsequent SD-WAN tunnel establishment between CPEs, inter-site key agreement, and site information exchange. The DTLS tunnel supports PQC technology, enhancing the security of the management channel. Subsequent inter-site key agreement is negotiated through the management channel, further reinforcing quantum-resistant security. The data channel between sites supports quantum-safe symmetric cryptographic algorithms. This creates a two-tier protection system with high-strength encryption on both the control and data planes, effectively defending against current cryptographic cracking and future quantum computing threats, addressing the complexities and security vulnerabilities of traditional point-to-point encryption configurations, and providing financial services with post-quantum-ready secure transmission assurance.

Application of PQC in an SD-WAN scenario

Application of PQC in Xsec-based Encryption and Decryption

In real-world applications, PQC is deeply integrated with Xsec to provide communication assurance against quantum computing threats for industries with high security requirements, such as finance and electric power.

The following figure uses the financial industry as an example. As shown in the figure, a bank employs SRv6 to construct an intelligent network between the HQ and branch, and adopts the Xsec solution integrated with PQC to achieve quantum-safe communication. In this solution, PQC algorithms are implemented during the BGP communication establishment phase to exchange keys, thereby defending against quantum computing attacks at the protocol level. Additionally, the solution combines control-plane PQC hardening with data-plane high-strength encryption based on Xsec's in-line encryption mechanism. This two-tier protection system not only effectively defends against current cryptographic cracking and future quantum computing threats, but also addresses the complexities and security vulnerabilities of traditional point-to-point encryption configurations, providing financial services with post-quantum-ready secure transmission assurance.

Application of PQC in Xsec-based encryption and decryption

Differences Between PQC and QKD

PQC and Quantum Key Distribution (QKD) are two important technologies for addressing the threats posed by quantum computing. They differ significantly in multiple aspects, such as basic concepts, technical foundations, security, functions, and application scenarios.