Post-Quantum Cryptography for Private Access
Post-Quantum Cryptography (PQC) refers to a new generation of cryptographic algorithms designed to secure digital data against the capabilities of future quantum computers.
Traditional encryption methods used in ZTNA tunnels today (such as RSA and ECC) rely on mathematical problems that could be easily broken by advanced quantum computers. PQC utilizes complex, multi-dimensional mathematical structures (such as lattices) that remain mathematically secure against both standard and quantum computers.
PQC in Skyhigh Private Access
Private Access tunnel segments enable quantum-safe TLS 1.3 algorithms by default for all TLS inspections starting with SSE 6.8.2 (June 2025). No manual configuration or policy changes are required.
Private Access traffic always flows through the Secure Channel (TLS 1.3), and PQC-capable key exchanges are now negotiated automatically at each encrypted tunnel hop in the traffic path.
How It Works
When a user accesses a private application, traffic traverses multiple encrypted segments. PQC strengthens each one:
NOTE: PQC support for IPSec, WireGuard, and OpenVPN tunnel segments to the Connector is currently under development. This is a critical component of the ZTNA tunnel architecture and will be supported in a future release.
At each segment, a hybrid key exchange combines a classical algorithm with a post-quantum algorithm. This ensures:
-
Backward compatibility: Connections continue to work if any intermediate component does not yet support PQC.
-
Forward security: Traffic encrypted today cannot be decrypted in the future by quantum computers ("store now, decrypt later" protection).
-
Zero-trust alignment: Every tunnel segment is independently quantum-resistant.
Supported PQC Algorithms
Key Encapsulation (Key Exchange): ML-KEM
|
Algorithm |
Security Level |
Application in PA |
|---|---|---|
|
ML-KEM-512 |
NIST Level 1 (128-bit equivalent) |
Standard tunnel establishment |
|
ML-KEM-768 |
NIST Level 3 (192-bit equivalent) |
Default hybrid key exchange (X25519MLKEM768) for Secure Channel |
|
ML-KEM-1024 |
NIST Level 5 (256-bit equivalent) |
High-security tunnel segments |
Digital Signatures — ML-DSA
|
Algorithm |
Security Level |
|---|---|
|
ML-DSA-44 |
NIST Level 2 |
|
ML-DSA-65 |
NIST Level 3 |
|
ML-DSA-87 |
NIST Level 5 |
Default Hybrid Key Exchange
The Secure Channel between Client Proxy and Cloud PoP uses:
X25519MLKEM768: A hybrid key exchange combining the classical X25519 ECDH algorithm with ML-KEM-768 for quantum resistance.
This is the same quantum-safe ciphersuite used by Skyhigh Secure Web Gateway for TLS inspection.
NOTE: Secure Channel is an optional configuration. PQC key exchange applies only when Secure Channel is enabled for Client Proxy access.
What Administrators Need to Know
|
Aspect |
Detail |
|---|---|
|
Enabled by default? |
Yes, since SSE 6.8.2 (June 2025) |
|
Configuration required? |
Yes |
|
Impact on Private Access policies? |
None, existing PA policy rules continue to work unchanged |
|
Impact on Connectors? |
Connector V2/V3 automatically benefit from PQC on the tunnel to Cloud PoP; no connector reconfiguration needed. |
|
Secure Channel required? |
Private Apps are always routed through the Secure Channel regardless of the "Enable Secure Channel" setting. |
|
Performance impact? |
Negligible, hybrid key exchange adds minimal overhead to tunnel handshakes |
|
Client Proxy requirements? |
No client-side changes needed; PQC negotiation is handled by the cloud gateway |
|
SSH configuration? |
SSH version 9.9P1 (SSH PQC is relevant only for On-Prem SWG appliances) |