Chapter 23 — Quantum and post-quantum security: threat and failure analysis
Lesson map
Lesson 23 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Quantum-era threats"]
N2["23.2 Migration failure modes"]
N3["23.3 Risk scoring"]
N4["Engineering note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Quantum-era threats"]
N2["23.2 Migration failure modes"]
N3["23.3 Risk scoring"]
N4["Engineering note"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]
[Learning outcomes]
|
v
[23.1 Quantum-era threats]
|
v
[23.2 Migration failure modes]
|
v
[23.3 Risk scoring]
|
v
[Engineering note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) model quantum-era threats with STRIDE-style analysis; (2) analyse failure modes introduced by migration itself; (3) include downgrade and implementation attacks; and (4) prioritize with risk scoring. It builds on Chapters 15 and 22.
23.1 Quantum-era threats
- Harvest-now, decrypt-later: recording traffic protected by vulnerable key exchange.
- Future forgery: forging signatures on long-lived artefacts once a CRQC exists.
- Downgrade: an active attacker strips post-quantum options so peers fall back to classical-only exchange. TLS 1.3 protects the negotiation transcript, so downgrade requires breaking authentication — but misconfigured fallback logic in applications can reintroduce it.
- Implementation attacks: side channels and fault injection against new code (Chapter 31).
- Cryptanalytic surprise: a weakness found in a new scheme, as happened to Rainbow and SIKE (Beullens 2022; Castryck and Decru 2022).
23.2 Migration failure modes
Failure-mode and effects analysis (FMEA) applies: oversized handshakes dropped by middleboxes; clients that cannot parse new certificates; HSMs that cannot hold new keys; stateful signature keys reused after backup restore; interoperability failures between draft and final implementations; expired transition certificates. Each has a cause, effect, detection method and mitigation.
Several of these were seen earlier in BPA's case: the proxy that reset split ClientHellos, the key-import failure between HSMs, and the risk of LMS state reuse after a restore. Listing them in one table forces a detection method for each, which is often the missing part.
23.3 Risk scoring
Score likelihood and impact; for harvest threats, impact scales with data lifetime and volume. Avoid false precision: three or five levels with clear definitions are enough.
BPA uses three levels with written definitions: high impact means data with a lifetime over ten years or a safety function; medium means commercial data under ten years; low means short-lived operational data. Two assessors scoring the same item should reach the same level, and when they do not, the definitions are tightened rather than averaged. A score like three point seven on a five-point scale suggests a precision that the inputs cannot support.
23.4 Worked example
FMEA for BPA's crane firmware signing with LMS: failure "state counter reset after HSM restore" → effect "one-time key reuse enabling forgery" → detection "monotonic counter audit against log" → mitigation "HSM with state reservation, restore procedures that forbid rollback, separate key per signing site". Severity high, likelihood medium → priority action.
The detection step works because each signature carries its index: comparing the highest index seen in published firmware with the HSM's counter shows a rollback at once. Separate keys per site limit the damage of a mistake to one site's signatures.
23.5 Common errors and limits
- Analysing only cryptanalytic threats, not migration failures.
- Assuming hybrids remove the need to analyse downgrade.
- Numeric risk scores presented as measurements.
Most incidents in early migrations come from failure modes like the proxy reset, not from cryptanalysis, so an analysis limited to attacks misses the likely problems. Hybrids protect against breaking one component, but misconfigured fallback can still remove the post-quantum part entirely, so downgrade paths are analysed per application. Risk scores rank items; they are not measurements and should not be added up.
Engineering note
Finally, rank threats by when they can be realized. Harvest-now-decrypt-later is happening today for any recorded traffic, even though decryption needs a future machine; active forgery requires the machine to exist at attack time. This temporal split explains why the same organization can rationally migrate key exchange this year while scheduling signature migration for later, and it gives decision-makers a clear reason for the order of work rather than an undifferentiated list of quantum risks.
Exercises
- EX045 — Threat table. Produce a threat table for BPA's partner VPN covering the five threat classes. Rubric: 3 = each with mitigation.
- EX046 — FMEA row. Write an FMEA row for "middlebox drops two-segment ClientHello". Rubric: 3 = cause, effect, detection, mitigation, priority.
Synthesis
Threat analysis in the quantum era includes recording, future forgery, downgrade, implementation attacks and cryptanalytic surprise; migration itself has failure modes that FMEA makes visible.
Continue studying — chapter 23 of 50
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →