The race to protect the internet from future quantum attacks is about a specific danger. Today’s online security, namely public-key cryptography, including encryption and digital signatures, relies on mathematical problems that ordinary computers cannot solve fast enough to be useful to an attacker.
A sufficiently powerful quantum computer could change that. It could break widely used public-key encryption and digital signatures used to protect sensitive account data and access to personal accounts. In the wrong hands, that could expose encrypted data or allow an attacker to forge a trusted digital signature, impersonate a legitimate user and potentially walk through the digital front door to rob you blind..
No computer capable of doing that exists today. But NIST says organizations should begin migrating now because replacing cryptography embedded throughout software, networks and devices will take years to decades. Quantum computers already exist. What does not exist is a cryptographically relevant quantum computer capable of breaking today’s public-key cryptography. No one knows when a quantum computer powerful enough to break today’s public-key cryptography will arrive.
That is where a much more immediate problem appears. Some of the upcoming quantum-resistant replacements to secure our digital lives do not fit comfortably inside systems built around today’s cryptography.
OpenID Connect is a good example. You’ve used it. Everyone has. It’s the “Sign in with Google,” “Sign in with Microsoft” or “connect this app” button. Google describes that token as a cryptographically signed package that the receiving application validates before trusting the identity inside it.
In plain English, Google is handing the application a tamper-resistant note (ID token) that says: “We authenticated this user. Here is who the token is for, when it expires and other information needed to check it. Here is our signature proving nobody changed the note.”
Now comes the size problem.
In a technical analysis published Thursday, OpenID said a common 256-byte RS256 signature used today to sign ID tokens is 256 bytes. One leading quantum-resistant replacement, ML-DSA-44, produces a 2,420-byte signature. That’s nearly 10 times larger. Another post-quantum option produces signatures of 7,856 bytes.
Think of the old signature as a one-page form. The ML-DSA replacement is roughly a 10-to-30-page packet. Both accomplish the same basic job, but the post-quantum signature makes the document inside the envelope much thicker.
Why Size Matters
A few thousand bytes sounds like nothing on a modern computer. But some applications store these signed ID tokens inside browser cookies so the browser can remember that you have already logged in as you move through a website or a single sign-on system.
That can include the plumbing behind workplace email, cloud services and business applications reached through SSO, as well as consumer sites that offer buttons such as “Sign in with Google” or “Sign in with Microsoft.”
The problem is many systems effectively treat about 4 kilobytes as the practical cookie limit. A post-quantum signature can consume much of that space before the rest of the ID token — the user information, expiration time and other security data — is even added.
So, think of the cookie as the envelope. Developers are putting a much thicker security document inside without making the envelope any bigger.
If the package exceeds the limit, OpenID warns that some browsers or applications may simply reject the cookie. Depending on how the service is configured, that could mean a frustrating login loop. It might also mean no access at all until the application can handle the new post-quantum signatures.
Nothing has been hacked. The cryptography worked perfectly. The application simply never receives the proof that the user logged in. Across millions of applications, tomorrow’s security upgrade could become today’s broken login screen.
Size is only the first problem.
Another issue is making sure the software that creates and verifies today’s ID tokens understands ML-DSA. ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is a post-quantum digital signature system designed to replace quantum-vulnerable signature schemes such as RSA and ECDSA.
The problem is that much of the software used to create and verify ID tokens still does not support ML-DSA. These reusable chunks of code (known as JWT libraries) are what developers use to build authentication systems.
OpenID reported Thursday that most of the popular JWT libraries used to build today’s identity systems still do not support ML-DSA post-quantum signatures.
Some fail even earlier. An OpenID issue documented in August found libraries that encounter one unfamiliar post-quantum key and reject the entire key set, including conventional keys they already understand.
This isn’t good. OpenID said this could cause existing logins to fail even before an application starts using post-quantum signatures.
And the transition is already underway. The IETF has standardized ML-DSA for web technologies, while NIST says its first post-quantum cryptography standards are ready for implementation now.
OpenID’s fix is less exotic than the problem.
Start testing now. Software libraries need to add post-quantum support and fix bugs triggered by unfamiliar keys. Developers need to look for size limits in browsers and applications. And systems may need to support both conventional and quantum-resistant signatures while older software catches up.
Is Q-Day the Next Y2K Moment for Tech?
No one knows exactly when a quantum computer powerful enough to threaten today’s cryptography will arrive. NIST says estimates for a computer powerful enough to threaten today’s encryption range from a few years to a few decades, with some experts putting it less than 10 years away.
But websites do not have to wait for that machine to exist before things start breaking. The potential Y2K moment comes during the migration itself, as identity providers and applications begin using post-quantum signatures that older software – and sometimes browsers carrying the resulting larger tokens – was never built to handle.
That transition will accelerate this decade. NIST is working toward phasing quantum-vulnerable cryptography out of its standards by 2035, with high-risk systems moving earlier. In other words, the quantum threat may still be years away, but the compatibility problems OpenID is warning about could begin showing up as soon as organizations start flipping on the new technology.
Image Credit: Markus Winkler via Pexels
