FORTRESS Explained #7

FORTRESS Explained #7:

What makes communication “secure”, and why does quantum computing threaten it?

Every time you check your bank balance, send a WhatsApp message or see the padlock icon in your browser, secure communication is at work. The data is encrypted so nobody can read it in transit, both ends prove who they are, and any tampering is detected.

The hardest part is the very first step: two devices that have never meet must agree on a shared secret key over a network, to which anyone might be listening. Today this “key exchange” relies on classical public-key algorithms such as RSA(Rivest–Shamir–Adleman) and elliptic-curve cryptography, the same algorithms a sufficiently powerful quantum computer could break.

Harvest now, decrypt later

This is not just a future problem while an adversary can record encrypted traffic today, store it cheaply, and decrypt it years from now once quantum computers catch up. This matters most where confidentiality must hold for decades: military and defence communications, and the critical national infrastructure Europe depends on, from energy grids and telecoms networks to transport and water systems. Command traffic or grid control data intercepted today could still be valuable to a hostile state in the 2040s. This “harvest now, decrypt later” threat is the reason why the migration to post-quantum secure communication has already started.

The replacement for classical key exchange is ML-KEM, the Module-Lattice-Based Key-Encapsulation Mechanism, standardised by NIST (National Institute of Standards and Technology) as FIPS 203( Federal Information Processing Standards) in August 2024. It does the same task of establishing a shared secret key, but it is based on mathematical problems believed to resist quantum attack. In practice it is often deployed in the PQ/T (Post-Quantum/Traditional) hybrid schemes we covered in FORTRESS Explained #3.

Secure comms in FORTRESS

Strong algorithms alone are not enough: the keys protecting a channel must be generated, stored and used somewhere safe. In FORTRESS, the secure communication component is anchored in the project’s post-quantum Root of Trust, so session keys are protected by hardware rather than exposed in software, and the same systematic physical security evaluation described in our earlier posts is applied where key leakage would be most damaging. By demonstrating post-quantum secure communication in critical infrastructure settings, and publishing the evidence openly, FORTRESS supports the wider adoption of post-quantum cryptography across the EU.