The Quantum Risk to Your Network Lives in the Handshake

Someone may be recording your encrypted traffic right now. They can't read it, but they don't need to yet. They are betting that within a few years, a quantum computer will hand them the key, and they're willing to store your data until it does.

The security community calls this "harvest now, decrypt later." It's why post-quantum cryptography (PQC) now has a budget line. My colleagues and I recently published three WWT Research Notes on what that spend looks like in the campus LAN, on the WAN and in carrier core routing. 

Read the research

1. Post-Quantum Cryptography Support in the Campus LAN
2. Post-Quantum Cryptography on WAN Technologies
3. Post-Quantum Cryptography in Carrier Core Routing

Here is a less technical overview of the issues we explore in those three pieces.

The lock is fine. The key handoff is the problem.

Every encrypted connection has two parts: the encryption that scrambles data in motion and a brief handshake at the start, where both ends agree on a secret key. The scrambling uses AES, which is resistant to quantum computers. The handshake uses the math that quantum computers are built to break: RSA and elliptic curve cryptography.

An attacker who records the handshake and the traffic behind it can, once a capable quantum computer exists, crack the handshake, pull out the key and read everything. Years of it. Healthcare, financial services and government data all have long retention requirements, meaning that traffic still has value even after decryption. "Q-Day," the moment a quantum computer can do this, is just the day they cash out.

The fix is a new kind of handshake. NIST finalized the algorithms in August 2024. The rest of the work is getting them into your network without breaking anything.

Three networks, three different problems

Campus LAN: If your campus encrypts switch links with MACsec, the AES scrambling itself holds up. The exposure lies in the authentication step that issues keys. That step runs on your certificate infrastructure and identity servers. If your switches run current software, this is a configuration and certificate project, and the switches stay. The catch is your public key infrastructure (PKI): It is almost certainly the bottleneck, and modernizing it is typically a multi-year program in its own right.

WAN and SD-WAN: This is where vendors have shipped. Fortinet, Cisco and Palo Alto Networks all delivered production post-quantum capabilities in 2025 and 2026. The added cost is a few extra kilobytes during connection setup. On healthy links, users won't notice. On weak or high-latency links, connection setup can slow by 10% to 30%, and a small tuning change recovers much of that. Once a tunnel is up, throughput is unchanged. Start here. Long-lived WAN traffic is the prime harvesting target.

Carrier core routing: This is the hardest migration in networking. Core routers stay in service for seven to 10 years or more, so a platform bought today without post-quantum support will still be running when the threat arrives. Every peering link has another company's equipment on the far end, so migration becomes a negotiation. Some of the internet's foundational trust protocols haven't yet finalized post-quantum standards. Carriers can still act. Cisco and Nokia platforms already offer interim protection for encrypted tunnels, and hardware refresh decisions made this year decide what's possible in 2030.

What it costs and what it doesn't

Compute is a rounding error. The new key exchange adds microseconds. The real costs show up elsewhere: extra bytes during handshakes, PKI and certificate work, and the hours it takes to inventory what you have. 

In a live proof of concept WWT ran with a global financial services firm, the cryptography was the easy part. The work was finding every place classical encryption was used, automating certificate management and flagging older edge gear due for refresh.

Four things to do in 2026

1. Inventory your cryptography: Find every tunnel, link and management session that still relies on classical key exchange. Nothing else on this list works without it.
2. Audit your PKI: All three domains depend on the same certificate authorities and identity servers. Fix them once. Coordinating LAN and WAN planning keeps you from paying for the same upgrade twice.
3. Run in hybrid mode: Hybrid negotiates a classical key and a post-quantum key simultaneously, so nothing breaks if a device on the far end hasn't been upgraded. Expect to live here for a while. That's by design.
4. Make refresh decisions with 2030 in mind: The NSA's CNSA 2.0 timeline calls for quantum-resistant networking equipment by 2030 and full transition by 2035. WWT assesses that a capable quantum computer could arrive as early as 2029. Any hardware you buy this year should be able to get there.

The organizations that do the inventory and testing in 2026 will have options when the timeline compresses. Those who wait will do this under a deadline, using whatever hardware they happen to have at the time.

If you're interested in learning more, sign up for a Post-Quantum Cryptography Briefing from WWT. In it, we'll work with your key stakeholders to identify where post-quantum-vulnerable cryptography lives across your estate, when regulatory deadlines and quantum risk require you to act and how WWT helps close the gap.