Threat modeling post-quantum strategy

Racing to beat an unknowable deadline ahead of quantum computing breaking legacy cryptography, achieving the defenses we would wish to be in place in time, or to meet announced stated goals varying by country has a long way to go. However, what exactly are we wishing for and what minimum level of defense would be acceptable assuming we will not get all that we wish for? Threat modeling would answer this clearly and more importantly explain the thinking behind the goals, but I can’t find one.

I’ve seen a consensus strategy and lots of excellent work on the advanced maths and technology fronts, but no clear fact-based reasoned answers to these simple questions that underlay the strategic direction that all this impressive work is directed to serve.

From admittedly very little research I don’t understand the wisdom of this strategy — from a system-level threat perspective, nothing to do with the PQ algorithm choices which are a hot topic. There is a remarkable (unprecedented) lack of debate and disagreement which is always a big red flag in my experience. After all this is both software and public policy, and I cannot think of any prominent topic, past or present, enjoying such a lack of opposing views.

I’m certainly no expert in this area (I do have software experience and some ancient cryptography work) but would think it’s noncontroversial to say that it is a sufficiently important problem that it requires careful analysis: the choice strategy here is hardly a “no brainer”. That is, the experts responsible for defending our digital infrastructure from a future quantum break should be showing their work: unless I’ve somehow missed it completely, that alone is cause for grave concern in my view given the stakes.

Far and away the best threat model I could find (Google’s Threat model for Post-Quantum Cryptography) is excellent work but narrowly scoped. High level, heavily focused on algorithms and software technology, I would call it a threat model interpretation: it states conclusions without referencing a thorough threat model with the full scope of the potential risks. I take it here as a summary of the broad discussion and strategic decisions driving current work.

The full details and a serious threat model is out of scope here so I’ll focus on the holes in what I can find based on first principles, and I’m happy to elaborate or discuss and learn, but in my view there are many reasons for concern I will try to concisely point out in hopes of strengthening if not gaining wider understanding of the challenge and our best strategy. Everything following is all in my limited view and “in a nutshell”; take with a grain of salt because there is so little context and data publicly available. I hope I’m entirely wrong and welcome being corrected …

• Threat model of future PQ breaking secure algorithms:
  • Confidentiality: key exchange (KEM) combined with Store-Now-Decrypt-Later (SNDL) data collection exposes present day traffic in the future
  • Authentication and Non-repudiation: PKI digital certificate forgery allows undetectable impersonation and enables repudiation unless time of signature can be proven before PQ was possible (that’s a very high bar to meet)
  • These two major threats are fundamentally different risks (apples and oranges)
• Strategy:
  • all-out effort to deploy PQ KEM against ambient confidentiality (by SNDL) threat
  • work on the “harder” problem of PQ PKI heavily deprioritized if not ignored for now
• Assumptions (unarticulated and over-simplified, without rigorous analysis behind):
  • PQ discussions today treat SNDL as a universal risk of massive proportions
  • the risk of confidentially compromise is simply deemed “obviously” greatest
  • an implicit “all hands on deck” for PQ KEM over PQ PKI risk, as if strategy must throw its full weight behind one or the other rather than a holistic stance
  • solutions under consideration exclusively target addressing the threats for the long-term rolled out worldwide to reach every connected system of all kinds

My critiques and concerns follow (in effect I threat modeled the attacker’s perspective):

• Attack effectiveness is extremely limited (even nation state threat actors) which must be accounted for in assessing the risk, especially with two different kinds of threat.
  • Drop in the ocean: practical data collection for SNDL must focus on a tiny fraction of the internet with limited taps feeding limited storage with limited bandwidth
  • Blind Needle in haystack: filtering on minimal metadata is crude and unreliable
  • Discoverability: long-term net tapping and exfiltration is very hard to conceal
  • Scalability: first PQC to crack cryptography will be a precious resource that will be wasted unless high value secret sessions can be identified with high precision
  • Timeliness: many high value secrets will rapidly lose value over time (for SNDL)
• Given the reality of attack capabilities, if this is a prime concern then many simple mitigations can be implemented at relatively low cost today with existing technology. All can be implemented now to protect the high value secret data on the net so long as both endpoints have the technology — no big rollout needed.
  • Obfuscate endpoint IP addresses (onion routing etc.)
  • Pad high value channels with dummy traffic indistinguishable by metadata
  • Embed secrets in large streams (e.g. video) to waste attacker storage and bandwidth
  • Encrypted Client Hello (ECH)
  • Secure local networks: keep high value traffic to small private network; secure Wi-Fi or hardwire to make harvesting more difficult, etc.
• Both threats (confidentiality and authentication/repudiation) must be carefully considered.
  • Setting strategy without bothering to threat model real world risks is beyond my comprehension.
  • Blithely ignoring these mitigation factors demonstrates a lack of needed analysis.

Next steps: KEM is underway, focus on PQ PKI where the need is greatest (high value secrets).

• Curate comprehensive threat models for all major PQ threats along lines sketched above.
• Comparing and prioritizing threats is subjective — is there any reason not to address both?
• Priority adopters of PQ PKI can self-select and take action based on risk tolerance.
• Selectively implement conventional SNDL countermeasures ASAP where needed.
• Begin work in earnest on PQ PKI for systems defending high value secrets.
  • Decouple from work targeting worldwide PQ roll out to full internet infrastructure
  • Review existing hybrid and private PKI research and develop as needed
  • Select suitable PQ algorithms for signatures
  • Stand up PQ PKI trusted root CAs using current PQ algorithms
  • Reduce intermediary CAs to minimize certificate size expansion (from larger keys)
  • Adapt cryptography protocols and implementations to support PQ algorithms with large key sizes (consider custom versions as stopgap is necessary)

The closest to a justification I have uncovered is Mosca’s Equation which is quite simplistic.

• it completely ignores the authentication threat of digital certificate forgery;
• variables of the equation X + Y > Z are extremely difficult to determine with any accuracy;
• X (confidential data shelf life) is hardly a clean step function as implied;
• Y (PQ migration time) is only a planned estimate subject to many delays;
• Z (PQ break) is notoriously hard to predict, nation state PQ efforts are tightly guarded;
• any large enterprise will have all manner of data, sensitivity timelines, migration issues;
• enterprises wishing to migrate may be delayed by legacy dependencies out of their control.

This thumbnail threat model (under an hour of solo work, not counting writing it up) of a potential PKI signature break clearly indicates that both risks deserve serious before heavily front loading work on one ahead of the other. I have no doubt this is flawed and incomplete but I do think it raises lots of questions; wrong as it might be, the way to improve or replace it is sharing a better threat model and facts pertinent to it.

Decisions like this are precisely what threat modeling is for; jumping to conclusions without one I cannot fathom, if only to share the reasoning behind the conclusions. This is one more spot-on example of what Publish Your Threat Models! The benefits far outweigh the dangers envisions. The strategy is very public: why isn’t the thinking behind it as well?