I am hoping to purchase a flexsecure or apex implant on cyborg Monday to use as a cryptographic anchor.
With the imminent mass adoption of post quantum cryptography however, I would hate to find that a new device is necessary to make use of these new algorithms.
I do not have the technical knowledge to determine if this would be a simple javacard applet update, or require some kind of hardware acceleration or other physical change to be usable.
Yubikey appears to be limiting this to new hardware, which adds fuel to my uncertainty. I am new to the world of hardware security devices however, and would appreciate clarity.
Generally speaking you need new hardware / silicon because the actual algorithms are baked into the silicon, not java card. Running cryptographic processes on smart card chips in Java is possible, but several orders of magnitude slower than when it’s baked into the silicon. Imagine a cryptographic function taking 80ms to run on silicon taking 10 whole seconds (or more) to complete when run as Java code on the same chip.
Current Apex and Apex 2 chips do not include PQ algos in silicon.
That said, from what I gather, the concern over quantum boils down to theory not practice. The actual physical efforts seem to be drastically lagging the theoretical (as it usually does). However, as companies race to bring quantum to the fore, it’s proving to be a bit like fusion power - it’s always just a few years away.
You’ll notice that they are not saying PQ (post-quantum) algorithms will be doing encryption / decryption on their new prototype hardware. They are only offering PQ signatures. This is still a significant leap in post-quantum security, but it does not protect encrypted data from being decrypted as the algorithms used to encrypt data blocks and data streams are still not “PQ”.
At best, I think this is a marketing announcement for a theoretical threat that has yet to bear real teeth IMHO. Personally, until the entire internet is actually using PQ algos to protect the mundane things like internet traffic, I don’t see any validity in waiting to take advantage of something like an Apex or flexSecure right now. If you’re always waiting for “the next best thing” then you’ll never have “the current best thing”.
