The German BSI now recommends a shift in long-term data protection, specifying that key exchange should use a hybrid approach combining classical methods with ML-KEM-768 or ML-KEM-1024. This guidance, detailed in version 2026-01 of Technical Guideline TR-02102-1, signals a move away from purely classical key exchange, which the BSI will no longer recommend after the end of 2031. Authorities like the BSI, ANSSI, and BACS all recognize the threat of a “harvest now, decrypt later” scenario, where data intercepted could be vulnerable to quantum computers within the decade.

Hybrid Key Sealing with P-256 and ML-KEM-768 Under BSI TR-02102-1

DuoKey SecureFolder implements a specific approach to protecting folder keys by sealing them with both P-256 and ML-KEM-768, a method detailed in alignment with the German BSI’s Technical Guideline TR-02102-1. This hybrid sealing process generates a 1218-byte block, ensuring the derived key remains secure as long as either the P-256 or ML-KEM-768 algorithms remain unbroken, a critical consideration given the evolving threat of quantum computing. The system’s design prioritizes securing the key handover process itself, recognizing that compromise of the folder key unlocks all contained files, rather than focusing solely on encrypting the file content.

The French ANSSI and Swiss BACS concur with this approach, advocating for hybridization as essential for post-quantum protection. ANSSI prefers the security level offered by ML-KEM-1024 while accepting ML-KEM-768 as an alternative. A core principle of the DuoKey SecureFolder design is the establishment of a three-level key hierarchy, beginning with a key encryption key (KEK) securely stored within a hardware security module (HSM) or vault, never leaving its protected environment.

This KEK is then used to encrypt the folder key, a 256-bit random value versioned and stored in encrypted form within the Cockpit system, and only released when sealed for a specific device or gateway. The final level, the file key, is derived using HKDF-SHA256 from the folder key and a random file identifier, and is never stored, instead being used to encrypt content in 64 KiB blocks with AES-256-GCM.

This tiered structure isolates the most sensitive key, the KEK, and minimizes the impact of potential compromises at lower levels. The hybrid sealing process itself involves each device and gateway registering both a P-256 public key and an ML-KEM-768 encapsulation key, with the corresponding private keys remaining securely on the device.

Upon key release, Cockpit generates a fresh P-256 key pair, computes an ECDH secret with the device, encapsulates a second secret with ML-KEM-768, and then derives a key from both secrets using HKDF-SHA-384, bound to a transcript of all public values, the folder and the key version. According to the design, “A quantum computer that breaks P-256 fails against ML-KEM-768; an unexpected weakness in ML-KEM is covered by P-256,” highlighting the defense-in-depth strategy employed. To prevent downgrade attacks, where an attacker attempts to force the system to revert to a less secure classical scheme, SecureFolder incorporates several safeguards.

The gateway actively rejects any key that is not hybrid-sealed, regardless of any conflicting instructions from Cockpit, and Cockpit itself only registers gateways with both public keys, never replacing them. A device’s ML-KEM-768 key is never replaced or removed once registered, and the version, folder, and key version are bound into every seal as additional authenticated data. This multi-layered approach ensures the integrity of the key exchange process and prevents attackers from exploiting vulnerabilities in either algorithm.

The implementation details extend to specific algorithms used for various aspects of data protection. File content is encrypted using AES-256-GCM in 64 KiB blocks with a random 96-bit nonce, while file key derivation relies on HKDF-SHA256 with the file identifier as salt. Header integrity is maintained using HMAC-SHA256, ensuring any modification to the header is immediately detected.

Editing tokens, used for collaborative editing with WOPI, are encrypted with AES-256-GCM, derived with HKDF and designed to reveal neither the user nor the file path. Editor signatures, verified on every call with key rotation, use RSA PKCS#1 v1. 5 SHA-256. While hybrid key handover represents a step forward, the BSI emphasizes that it is not a complete solution for post-quantum migration.

The organization recommends extending hybrid key exchange to transport layer security (TLS) connections between browsers, Nextcloud instances, gateways, and Cockpit, as well as conducting a thorough cryptographic inventory to identify any remaining instances of purely classical schemes. Prioritization should be given to folders containing documents requiring confidentiality for more than ten years, acknowledging the immediate risk posed by the “harvest now, decrypt later” threat.

Source: https://duokey.com/en/resources/post-quanten-schluesselverwaltung-dokumente-hybride-versiegelung

More like this