hanzoai/papers
2
0
Fork 0
mirror of https://github.com/hanzoai/papers.git synced 2026-10-22 17:20:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

paper: HIP-0302 update PQ section to reflect deployed stack

Browse Source 
Replace speculative PQ migration phases with deployed scorecard:
age1pq S3 backup, X25519MLKEM768 TLS, ML-DSA-65 JWT signing,
PQ KEM MPC transport, Cloud HSM master keys (FIPS 140-2 L3).
This commit is contained in:
zeekay
2026-03-01 19:27:12 -07:00
parent 6494d6a2e8
commit b030a371e2
1 changed files with 60 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hip-0302-replicate.tex
+60 -51
View File
@@ -770,70 +770,79 @@ seconds for any service.
\end{itemize}
% ============================================================================
% 11. POST-QUANTUM CONSIDERATIONS
% 11. POST-QUANTUM SECURITY
% ============================================================================
\section{Post-Quantum Considerations}
\section{Post-Quantum Security}
The age encryption layer (Layer~2) currently uses X25519 (Curve25519)
key agreement, which is not post-quantum safe. A sufficiently powerful
quantum computer running Shor's algorithm could recover X25519 private
keys from public keys, retroactively decrypting all age-encrypted S3
objects.
The Hanzo ecosystem has achieved comprehensive post-quantum (PQ)
coverage across all cryptographic layers. All previously planned
mitigations are now deployed.
\subsection{Harvest-Now-Decrypt-Later Threat}
S3 replicas are long-lived. Snapshots are retained for 30 days by
default; compliance-critical buckets may retain data for years.
An adversary who captures encrypted S3 objects today could decrypt
them once a cryptographically relevant quantum computer (CRQC) becomes
available. This ``harvest-now-decrypt-later'' attack is the primary
quantum threat to this replication standard.
\subsection{Mitigation: X-Wing Hybrid KEM}
The mitigation is a hybrid Key Encapsulation Mechanism (KEM) called
X-Wing~\cite{xwing}, which combines X25519 with ML-KEM-768 (NIST FIPS
203~\cite{fips203}). If quantum computers never materialize, the X25519
component provides security. If they do, the ML-KEM-768 component
provides post-quantum security. Both must be broken to compromise the
hybrid.
\texttt{lux/crypto} already implements ML-KEM at
\texttt{encryption/mlkem.go}. The \texttt{hanzoai/age} fork will add
X-Wing as a new recipient type.
\subsection{Migration Phases}
\begin{description}
\item[Phase 1 (current):] X25519 recipients. Adequate for operational
data with limited shelf life. AES-256 at the sqlcipher layer
(Layer~1) already provides 128-bit post-quantum security via Grover's
bound, protecting on-disk data independently.
\item[Phase 2 (planned):] X-Wing hybrid recipients
(\texttt{age1xwing1...}) in \texttt{hanzoai/age}. Backward
compatible---old X25519 recipients continue to work. New replicas
encrypted to both X-Wing and X25519 recipients during transition.
\item[Phase 3 (future):] Pure ML-KEM-768 or ML-KEM-1024 recipients
when the ecosystem matures and X25519 is considered deprecated.
\end{description}
\subsection{Three-Layer Post-Quantum Status}
\subsection{PQ Scorecard}
\begin{table}[H]
\centering
\begin{tabular}{@{}llll@{}}
\toprule
\textbf{Layer} & \textbf{Algorithm} & \textbf{PQ Status} & \textbf{PQ Path} \\
\textbf{Layer} & \textbf{Algorithm} & \textbf{PQ Status} & \textbf{Status} \\
\midrule
1. Disk & AES-256 (sqlcipher) & Safe (128-bit PQ) & No change needed \\
2. S3 & age X25519 & Vulnerable & X-Wing (Phase 2) \\
3. Wire & TLS 1.3 & Depends on suite & PQ TLS when available \\
Disk encryption & AES-256 (sqlcipher) & Safe (128-bit PQ) & Deployed \\
HKDF derivation & HKDF-SHA-256 & Safe (128-bit PQ) & Deployed \\
Field encryption & AES-256-GCM & Safe (128-bit PQ) & Deployed \\
S3 backup & age ML-KEM-768+X25519 (\texttt{age1pq}) & Safe (FIPS 203) & Deployed \\
TLS & X25519MLKEM768 (first curve) & Safe (hybrid PQ) & Deployed \\
JWT signing & ML-DSA-65 (FIPS 204) & Safe (Module-LWE+SIS)& Deployed \\
JWKS validation & ML-DSA-65 & Safe & Deployed \\
MPC transport & Hybrid KEM (X25519+ML-KEM-768) & Safe & Deployed \\
MPC key shares & PQ KEM encryption & Safe & Deployed \\
Master keys & Cloud HSM (FIPS 140-2 L3) & Hardware isolation & Deployed \\
Chain signing & secp256k1 ECDSA & \textbf{Not PQ-safe} & EVM constraint \\
\bottomrule
\end{tabular}
\caption{Post-quantum status of each encryption layer.}
\label{tab:pq-status}
\caption{Complete post-quantum scorecard. All layers PQ-safe except EVM chain signing.}
\label{tab:pq-scorecard}
\end{table}
\subsection{S3 Backup Encryption (Deployed)}
All age encryption uses ML-KEM-768 + X25519 hybrid recipients
(\texttt{age1pq} prefix). The file key is derived from both shared
secrets: $\text{file\_key} = \text{HKDF-SHA256}(ss_1 \| ss_2,
\texttt{"age-hybrid-v1"})$. Label enforcement prevents downgrade to
classical-only recipients.
\subsection{TLS Post-Quantum (Deployed)}
All TLS 1.3 connections negotiate X25519MLKEM768 as the first curve.
This provides PQ protection for all data in transit, including S3
uploads and inter-service communication.
\subsection{JWT Signing with ML-DSA-65 (Deployed)}
Hanzo IAM issues JWT tokens signed with ML-DSA-65 (FIPS~204). The
JWKS endpoint exposes the ML-DSA-65 public key. All services validate
JWTs using the PQ-safe signature. EUF-CMA security under Module-LWE
and Module-SIS hardness assumptions.
\subsection{MPC Transport and Key Shares (Deployed)}
MPC node-to-node communication uses hybrid KEM (X25519 + ML-KEM-768).
MPC key shares at rest are encrypted with PQ KEM encryption.
\subsection{Cloud HSM for Master Keys (Deployed)}
Master encryption keys are stored in Cloud HSM (GCP Cloud KMS,
FIPS~140-2 Level~3 Cavium HSMs). The master key never leaves the HSM:
wrap, unwrap, and sign operations execute inside the HSM. Three
keyrings per ecosystem (devnet, testnet, mainnet), 12 keys total.
Mainnet uses HSM protection level.
\subsection{Harvest-Now-Decrypt-Later: Closed}
The combination of ML-KEM-768 hybrid encryption (S3), X25519MLKEM768
TLS (transit), ML-DSA-65 JWT signing (auth), PQ KEM for MPC, and
Cloud HSM for master keys closes the HNDL attack vector completely.
% ============================================================================
% 12. REFERENCES
% ============================================================================