Securing the Future: How Access Agent is Preparing for the Quantum Era

[JayGolf]

This blog was written by Vipin Marar, Principal Technical Marketing Engineer & Nehal Naik, Senior Product Manager

Quantum computing uses principles of quantum mechanics to process information using qubits that can exist in superpositions of states simultaneously, enabling them to compute exponentially faster than classical computers. While this promises incredible technological leaps, it also poses a massive cybersecurity threat. Quantum computers will render today’s cryptography ineffective, eventually breaking the classical ciphers—like Diffie-Hellman (DH) and RSA—that currently secure our websites, certificates, and remote access tunnels.

The Immediate Threat: "Harvest Now, Decrypt Later"

You might be thinking, "If quantum computers aren't fully here yet, why worry now?"

The immediate threat is a tactic known as the "Harvest Now, Decrypt Later" attack . Today, threat actors are actively intercepting and storing encrypted communications, including data passing through remote SASE agents like Access Agent. Their goal is to hold onto this proprietary data until quantum computers become powerful enough to decrypt it.

Access Agent’s Defense: Post-Quantum Cryptography (PQC)

To combat this looming threat and protect customer data, Access Agent will implement Post-Quantum Cryptography (PQC). PQC relies on cryptographic algorithms specifically designed to be secure against quantum computer attacks.

Access Agent will roll out several key innovations to ensure secure remote access:

• Hybrid Key Exchange in TLS 1.3: Access Agent is combining traditional, classical key exchanges with new post-quantum algorithms (like ML-KEM).

• Post-Quantum Pre-Shared Keys (PPK): To secure IKEv2 connections, Access Agent will support the use of PPKs. These are incredibly complex secrets that are mixed into the connection process. Because they are not based on prime numbers, they are invulnerable to quantum cracking methods.
  

• Hybrid Key Encapsulation Mechanisms (KEM): Relying entirely on static PPKs can be risky; if a human loses or leaks the key, security is compromised. To provide maximum security, Access Agent layers PPKs with Hybrid KEMs, adding multiple, dynamic post-quantum key exchanges to the connection process for added insurance.

Why Organizations Must Act Now

The push for quantum readiness is already underway. NIST is actively standardizing PQC algorithms, and government agencies like the NSA are mandating transitions to quantum-resistant cryptography. Organizations in highly targeted verticals—such as government, finance, and healthcare—must ensure their remote workforces are protected.

By utilizing standards-based PQC methods, Access Agent is seamlessly blocking 'Harvest Now, Decrypt Later' attacks without breaking existing connections. Upgrading your infrastructure to support Post-Quantum Cryptography isn't just about preparing for the future—it's about protecting the data you are transmitting today.

Please reach out to your Palo Alto Networks representative for more information about PQC support for Access Agent.