Post-Quantum Cryptography for Remote Browser Isolation
Post-Quantum Cryptography (PQC) refers to a new generation of cryptographic algorithms designed to secure digital data against the capabilities of future quantum computers. Traditional encryption methods (such as RSA and ECC) rely on mathematical problems that advanced quantum computers could easily solve. PQC uses complex mathematical structures (such as lattices) that remain secure against both classical and quantum computers.
PQC in Remote Browser Isolation
RBI session enables quantum-safe TLS 1.3 algorithms by default for all TLS inspections starting with SSE 6.8.2 (June 2025). No manual configuration or policy changes are required.
Because RBI traffic always flows through Skyhigh SWG Cloud (SC > SWG > RBI ), PQC enforcement at the SWG TLS layer inherently protects all RBI use cases: Full Isolation, Risky Web, Cloud App Isolation (CAI), and Private Access with RBI.
How It Works
When a user's browser session is isolated via RBI, multiple encrypted connections are established. PQC strengthens each one:
[User Device]
│
├── (Secure Channel - TLS 1.3 + PQC) ──→ [SWG Cloud PoP]
│ │
│ ├── (Internal TLS + PQC) ──→ [RBI Master Controller]
│ │ │
│ │ [VM Manager → Session Container]
│ │ │
│◄── (WebSocket over TLS + PQC) ◄─────────────┘────────────────────────────────────┘
│ (Streamed browser view) │
│ │
│ └── (TLS 1.3 + PQC) ──→ [Origin Website]
At each segment, a hybrid key exchange combines a classical algorithm with a post-quantum algorithm, ensuring:
- Backward compatibility: Connections continue to work if any intermediate component does not yet support PQC.
- Forward security: Session data encrypted today cannot be decrypted in the future (store now, decrypt later protection).
- End-to-end protection: The entire RBI chain from user to isolated website is quantum-resistant.
Supported PQC Algorithms
Key Encapsulation (Key Exchange): ML-KEM
| Algorithm | Security Level | Application in RBI |
|---|---|---|
| ML-KEM-512 | NIST Level 1 (128-bit equivalent) | Standard session establishment |
| ML-KEM-768 | NIST Level 3 (192-bit equivalent) | Default hybrid key exchange (X25519MLKEM768) |
| ML-KEM-1024 | NIST Level 5 (256-bit equivalent) | High-security session workloads |
Digital Signatures: ML-DSA
| Algorithm | Security Level |
|---|---|
| ML-DSA-44 | NIST Level 2 |
| ML-DSA-65 | NIST Level 3 |
| ML-DSA-87 | NIST Level 5 |
Default Hybrid Key Exchange
All TLS connections protecting RBI session traffic use:
X25519MLKEM768: A hybrid key exchange combining the classical X25519 ECDH algorithm with ML-KEM-768 for quantum resistance.
What Administrators Need to Know
| Aspect | Detail |
|---|---|
| Enabled by default? | Yes, since SSE 6.8.2 (June 2025) |
| Configuration required? | No |
| Impact on RBI policies? | None. Full Isolation, Risky Web, and CAI policies continue unchanged |
| Impact on session performance? | Negligible, hybrid key exchange adds minimal overhead |
| Impact on WebSocket streaming? | None visible, session streams are protected transparently |
| Client-side requirements? | None, PQC negotiation is handled server-side by SWG/RBI infrastructure |