Post-Quantum Cryptography for SWG
Post-Quantum Cryptography (PQC) refers to a new generation of cryptographic algorithms designed to secure digital data against the capabilities of future quantum computers.
Traditional encryption methods used across the internet today (such as RSA and ECC) rely on mathematical problems that are practically impossible for standard computers to solve. However, advanced quantum computers will be capable of solving these mathematical problems easily, rendering standard encryption vulnerable. PQC utilizes complex, multi-dimensional mathematical structures (such as lattices) that remain mathematically secure against both standard and quantum computers.
PQC Support in Secure Web Gateway
To achieve full PQC compliance, Secure Web Gateway (SWG) addresses both TLS Inspection and SSH Connections.
TLS Inspection (Enabled by Default)
PQC support for TLS inspection is available natively out-of-the-box starting with Secure Web Gateway Version 13.0. Because SWG version 13.0 and later utilizes OpenSSL version >= 3.5, PQC algorithms are offered automatically during the TLS handshake. No manual configuration changes are required for TLS inspection to be PQC compliant.
- Utilize ML-KEM for Key Exchange
Skyhigh Security leverages Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) to handle secure key encapsulation and manage Transport Layer Security (TLS) key exchanges. The platform natively supports the following quantum-resistant parameter sets to ensure high-performance session establishment:
- ML-KEM-512
- ML-KEM-768
- ML-KEM-1024
- Deploy ML-DSA for Digital Signatures
Skyhigh Security implements Module-Lattice-Based Digital Signature Algorithm (ML-DSA) to validate digital signatures and authenticate certificate authorities. The system safeguards infrastructure integrity by supporting these specific parameter variants: - ML-DSA-44
- ML-DSA-65
- ML-DSA-87
Platform Availability
Quantum-safe TLS 1.3 ciphersuite support (X25519MLKEM768 hybrid key exchange) for TLS Inspection is available on the following platforms:
| Platform | Support Available Since | Notes |
|---|---|---|
| SSE (Cloud) | June 2025 (SSE 6.8.2) | PQS enabled by default; no configuration required |
| On-Premises (SWG) | March 2026 (SLOS) Version >=13.0 | Requires SLOS-based deployment; OpenSSL >= 3.5 included |
SSH Configuration (Manual Steps Required - Only for On-Prem SWG)
While TLS inspection is native, you must configure your SSH environment to use PQC key exchanges to protect against store now, decrypt later attacks, secure long-term sensitive data, and suppress system warnings.
Verify and Enable Post-Quantum Cryptography Algorithms for SSH Access
While SWG natively handles Post-Quantum Cryptography for web traffic (TLS) out-of-the-box, administrators who want to secure the appliance's management plane against quantum threats can also enforce PQC algorithms for backend SSH access.
Because modifying SSH settings impacts administrative access to the appliance, this requires manual configuration.
For step-by-step instructions on verifying and enabling quantum-safe algorithms for your SSH daemon, see PQC Algorithms for SSH Access (SWG).