gRPC and Post-Quantum Cryptography
summary
gRPC now prefers a X25519+MLEM-768 hybrid key exchange to provide post-quantum confidentiality, rolled out in C++ and Go with Java dependent on JDK support, and benchmarks show about a ~8.7% CPU increase during TLS connection setup while bulk AES-GCM traffic is unchanged. Authenticity support is in progress: planned is MLDDSA for certificates and signature negotiation, but MLDDSA keys and signatures are large (~2.5KB public key, ~4.6KB signature) which affects PKI migration, memory, and bandwidth.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:04What is postquantum crypto
- 3:07Quantum threats to crypto
- 4:11Symmetric vs asymmetric crypto
- 7:25Cost of postquantum crypto
- 9:11gRPC solution for confidentiality
- 11:59Hybrid key exchange in gRPC
- 14:05gRPC solution for authenticity
- 16:37PKI migration challenges
- 19:09Summary and next steps
related talks
29mThe Go Cryptography State of the Union
30mPost-Quantum Crypto Integration for Enterprise Applications
58mLet's Go Quantum
51mJava and Post-Quantum Cryptography
46mFrom Theory to Practice: Real-World Lessons in Post-Quantum Cryptography Migration
23mReal-World Post-Quantum Migrations: Lessons Learned and Performance Results
24mTransitioning to Post-Quantum Cryptography in IAM
47mReal-World Lessons in Post-Quantum Cryptography Migration