Post-Quantum Cryptography for Prisma SD-WAN
Learn how Post-Quantum Cryptography (PQC) protects your VPN connections against
future quantum computer attacks.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma SD-WAN (Managed by Strata Cloud Manager)
|
- Prisma SD-WAN
- ION device software version 6.8.1 or later
|
Starting in release 6.8.1, Prisma SD-WAN supports Post-Quantum
Cryptography (PQC) to protect encrypted connections against future quantum computer
attacks. PQC uses new NIST-approved algorithms that remain secure even when quantum
computers become powerful enough to break classical encryption methods like RSA and
Diffie-Hellman. This protection is critical because attackers can harvest encrypted data
today and decrypt it later when quantum computers become available—a threat known as
"Harvest Now, Decrypt Later" (HNDL) attacks.
Prisma SD-WAN implements a hybrid approach that combines
classical encryption algorithms with post-quantum algorithms. This ensures your
connections remain secure even if quantum computers break classical encryption or if
flaws are discovered in new PQC algorithms.
Understanding Post-Quantum Cryptography
Post-Quantum Cryptography protects against "Harvest Now, Decrypt Later" (HNDL)
attacks where adversaries collect encrypted data today and decrypt it when quantum
computers become available. Prisma SD-WAN implements a hybrid
approach that combines classical encryption algorithms with NIST-approved
post-quantum algorithms to ensure security even if one algorithm is compromised.
For a comprehensive explanation of the quantum computing threat, how PQC
algorithms work, and the technical foundations of quantum-resistant security, see
the
Quantum Security documentation for Palo
Alto Networks firewalls. The concepts, algorithms, and RFCs described there apply
equally to
Prisma SD-WAN.
PQC Support in Prisma SD-WAN
Prisma SD-WAN supports quantum-resistant Standard VPN tunnels through
three IETF standards:
RFC 8784: Post-Quantum Pre-shared Keys (PPK)
RFC 8784 provides immediate quantum resistance by mixing a
quantum-resistant pre-shared key (PPK) with classical Diffie-Hellman key material.
The PPK is configured out-of-band on both VPN peers and is never transmitted over
the network, protecting against HNDL attacks. This is the recommended first step for
adding quantum resistance to your VPN connections because it adds virtually no
latency and requires no additional network resources.
RFC 9370 and RFC 9242: Additional Key Exchanges
RFC 9370 provides a more advanced quantum-resistant approach through
multiple rounds of hybrid key exchanges that combine classical algorithms (ECDH,
Diffie-Hellman) with NIST-approved post-quantum algorithms (ML-KEM-512, ML-KEM-768,
ML-KEM-1024). Each key exchange round uses a different algorithm, providing
cryptographic agility—if one algorithm is compromised, the other rounds maintain
security. RFC 9242 enables the IKE_INTERMEDIATE exchange to handle the larger key
sizes required by PQC algorithms. You can combine PPK with Additional Key Exchanges
for defense-in-depth protection.
For detailed technical information about RFC 8784, RFC 9370, and RFC 9242
implementation, including protocol diagrams and negotiation flows, see
Quantum Security Concepts.
Supported PQC Algorithms
Prisma SD-WAN supports the following NIST-approved
post-quantum key encapsulation mechanisms (KEMs):
- ML-KEM-768 (NIST Level 3)—Recommended for most deployments.
Provides security equivalent to AES-192 with reasonable performance.
- ML-KEM-1024 (NIST Level 5)—Use for high-security environments
that require maximum protection against quantum attacks. Provides security
equivalent to AES-256.
- ML-KEM-512 (NIST Level 1)—Offers faster performance with lower
security. Provides security equivalent to AES-128 and is suitable for less
sensitive data.
You can also select classical algorithms (MODP-1024, MODP-1536, MODP-2048,
ECP-256, ECP-384) or combine them with PQC algorithms in a hybrid configuration.
Configuring Post-Quantum Cryptography
You configure PQC features when you
create an IPsec profile for
Standard VPN connections. PQC configuration includes:
- Post-Quantum Pre-shared Key (PPK)—Configure a quantum-resistant
pre-shared secret on both VPN peers. The PPK is mixed with classical
Diffie-Hellman key material to protect against quantum attacks.
- Additional Key Exchanges—Configure up to 7 additional key
exchange rounds for both IKE and ESP, selecting classical or post-quantum
algorithms for each round.
After you configure PQC in your IPsec profile, you assign the profile to a
Standard VPN interface. You can use PQC-enabled IPsec profiles for:
- Standard VPN connections to third-party peers
- Any Standard VPN tunnel where quantum resistance is required
Verifying PQC Configuration
After you configure a Standard VPN interface with a PQC-enabled IPsec
profile, you can verify the configuration and active tunnel status using CLI
commands. For command syntax and output details, see the
ION CLI Reference.
Important Considerations
FIPS and Common Criteria Impact
FIPS mode is not available in release 6.8.1 because the cryptographic
libraries (OpenSSL 3.5.4, Strongswan 6.0.x) are not yet FIPS-validated. If your
environment requires FIPS or FIPS-CC compliance, do not upgrade to release 6.8.1. For
more information, see
FIPS and FIPS-CC Security.
Downgrade Restrictions
If you configure Post-Quantum Cryptography features on an ION device
running release 6.8.1 or later, you cannot downgrade the device to an earlier
software version until you remove the PQC configuration. Attempting to downgrade
without removing PQC configuration will result in failure.
To resolve downgrade errors caused by PQC configuration:
- For each IPsec profile linked to the downgrade error, edit the profile
and disable Post-Quantum Pre-shared Key (set to Off) and disable Additional Key
Exchanges.
- After saving the profile changes, retry the downgrade. The error
message lists the profile names that need to be updated.
You do not need to remove the Standard VPN interfaces—only the PPK and
Additional Key Exchanges configuration on the linked profiles must be disabled. For
more information, see
Upgrade ION Device Software.
Interoperability
When configuring Post-Quantum Cryptography for site-to-site VPNs with PAN-OS
Next-Generation Firewalls, both VPN peers must support the same PQC features:
- The remote firewall must run PAN-OS 11.1 or later to support RFC
8784 (PPK) and RFC 9370/9242 (Additional Key Exchanges).
- Both peers must configure identical PPK KeyID and Secret values.
- Both peers must support the same ML-KEM algorithm selections (at least
one common algorithm per round).
- For third-party VPN peers, verify they support the IETF standards RFC
8784, RFC 9370, and RFC 9242.
If the remote peer does not support PQC, you can configure the PPK mode to
Preferred to allow fallback to standard IKEv2. For
Additional Key Exchanges, you can select classical algorithms or
None for specific rounds to maintain compatibility with
peers that do not support PQC.
