On top of all these considerations, these algorithms must also be performant on commercially available hardware, providing yet another layer of challenge to this already complex problem. Hybrid mechanisms such as X25519Kyber768 provide the flexibility to deploy and test new quantum-resistant algorithms while ensuring that connections are still protected by an existing secure algorithm. This is not theoretical: in 20, several leading candidates for quantum-resistant cryptographic algorithms have been broken on inexpensive and commercially available hardware.

Quantum-resistant cryptography must also be secure against both quantum and classical cryptanalytic techniques. Many types of asymmetric cryptography used today are considered strong against attacks using existing technology but do not protect against attackers with a sufficiently-capable quantum computer. One such advancement is the development of quantum computers, which will be capable of efficiently performing certain computations that are out of reach of existing computing methods. There’s a common mantra in cryptography that attacks only get better, not worse, which highlights the importance of moving to stronger algorithms as attacks advance and improve over time. The strength of this cryptography is expressed in terms of how hard it would be for an attacker to violate one or more of these properties. Modern networking protocols like TLS use cryptography for a variety of purposes including protecting information (confidentiality) and validating the identity of websites (authentication). The remainder of this post provides important background information to help understand this change as well as the motivations behind it. If you are a developer or administrator experiencing an issue that you believe is caused by this change, please file a bug. Chrome may also use this updated key agreement when connecting to third-party server operators, such as Cloudflare, as they add support. In order to identify ecosystem incompatibilities with this change, we are rolling this out to Chrome and to Google servers, over both TCP and QUIC and monitoring for possible compatibility issues. Kyber-768 – a quantum-resistant Key Encapsulation Method, and NIST’s PQC winner for general encryption X25519 – an elliptic curve algorithm widely used for key agreement in TLS today This hybrid mechanism combines the output of two cryptographic algorithms to create the session key used to encrypt the bulk of the TLS connection: Continuing with our strategy for handling this major transition, we are updating technical standards, testing and deploying new quantum-resistant algorithms, and working with the broader ecosystem to help ensure this effort is a success.Īs a step down this path, Chrome will begin supporting X25519Kyber768 for establishing symmetric secrets in TLS, starting in Chrome 116, and available behind a flag in Chrome 115. Teams across Google are working hard to prepare the web for the migration to quantum-resistant cryptography.

Google chrome portable archive