Beware of Downgrade Attacks during the Migration to Quantum Resistance

During the quantum-resistant migration’s transitionary phase there is a need for backwards compatibility and manageability. This means that old and new cryptography may be in use at the same time, creating a real risk of downgrade attacks. This talk sets out the problem of limiting downgrade risk during migration, focused on the use-case of end-to-end authenticated commands from an authority to a device, which is a critical use-case for managing infrastructure and devices. We pose several strategies for migration and provide practical ways to mitigate and manage the downgrade risk and minimise the exposure time window. In this use-case the problem is compounded when commands are sent one-way and do not receive a response, and when it takes time to upgrade authorities and devices. Furthermore, with new quantum-resistant standards emerging and best-practice for selecting algorithms and parameter sets likely to evolve, this transition will likely not be the last. Planning today’s migration with cryptographic agility in mind to reduce the downgrade risk during future changes is therefore important. Greater recognition of the real challenges of the downgrade risk and how to address it will equip vendors and IT managers with strategies to reduce their exposure and manage risks during their quantum-resistant migration and future cryptographic transitions. By setting out the problem we also hope to establish a foundation for further research in this area that many will depend on.