Why the Internet Is Preparing for Quantum Computers

A simple SSH warning reveals one of the biggest changes in modern cryptography.

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

Introduction

When connecting to an SSH server today, you might see a warning about missing post-quantum key exchange and potential exposure to “store now, decrypt later” attacks. This is not an alert about an active attack or a misconfiguration. It is a signal that the security of today’s connections depends on how computing evolves in the future.

The Internet has already begun preparing for the era of quantum computing.

How it worked so far

For decades, the model has been consistent:

First, establish a shared secret (key exchange).
Then, encrypt data using a fast symmetric algorithm such as AES.

The hardest part has always been securely agreeing on that secret over a public network. This is what Diffie-Hellman and later ECDH solved.

The key property: the secret is never transmitted. Each side generates it locally, and only intermediate public values are exchanged.

For classical computers, deriving the secret from those values is computationally infeasible. This assumption underpins TLS, SSH, VPNs, and most secure communication today.

What is changing

Current algorithms are not broken. The issue is that they were never designed with quantum computers in mind.

Shor’s algorithm demonstrates that the mathematical problems behind RSA and elliptic-curve cryptography could become solvable with sufficiently powerful quantum hardware.

That does not mean they are broken today. It means they might be in the future.

“Store now, decrypt later”

The most relevant threat is not immediate.

The attack model is simple:

capture encrypted traffic today,
store it without decrypting,
wait for technological advances,
decrypt it in the future.

This matters for long-lived data such as medical records, financial data, or intellectual property.

So the SSH warning is not about the present – it is about the future value of today’s data.

What is actually at risk

Symmetric encryption (like AES) remains relatively secure. In a post-quantum context, increasing key sizes is generally sufficient. The real weakness lies in key exchange. If an attacker can reconstruct the session secret, the strength of AES becomes irrelevant. That is why current efforts focus on replacing public-key algorithms rather than symmetric ones.

Post-quantum cryptography

New algorithms are not just larger versions of existing ones. They rely on different mathematical foundations, most commonly lattice-based problems.

To understand the shift, it helps to look at how key exchange works in practice.

Classical key exchange (before)

In schemes like Diffie-Hellman or ECDH:

Each side generates a private key.
They exchange public values derived from those keys.
Both sides independently compute the same shared secret.

Even if an attacker captures all transmitted data, reconstructing the secret is infeasible for classical computers.

Example flow:

Step	Alice	Bob	Network
1	Generate private key $a$ a	Generate private key $b$ b
2	Compute public value $A$ A	Compute public value $B$ B
3	Send $A$ A →		$A$ A
4		← Send $B$ B	$B$ B
5	Compute secret from $B, a$ B,a	Compute secret from $A, b$ A,b
6	Shared secret established	Shared secret established

Key point: security relies on the difficulty of reversing $A$ A or $B$ B back into private keys.

Post-quantum key exchange (now)

In lattice-based schemes like ML-KEM, the structure is different. Instead of symmetric contribution (both sides deriving the same secret in the same way), one side encapsulates a secret and the other decapsulates it.

The security of schemes like ECDH relies on the computational difficulty of the elliptic curve discrete logarithm problem (ECDLP), which is considered infeasible to solve using classical computers.

One side generates a public/private key pair.
The other uses the public key to encrypt (encapsulate) a shared secret.
The first side decrypts (decapsulates) it to obtain the same secret.

Example flow:

Step	Alice	Bob	Network
1	Generate key pair (pk, sk)
2	Send public key →		pk
3		Generate shared secret $K$ K
4		Encrypt $K$ K using pk → ciphertext
5		Send ciphertext ←	ct
6	Decrypt ct using sk → recover $K$ K
7	Shared secret established	Shared secret established

Key difference:

Classical: both sides derive the same secret.
Post-quantum: one side creates the secret, the other recovers it.

What changes in practice

From an implementation perspective (e.g., OpenSSH):

You often do not choose one or the other.
Hybrid mode combines both:
- Classical (e.g., X25519)
- Post-quantum (e.g., ML-KEM)
Final session key = combination of both secrets.

This means:

Even if one method is broken, the other still protects the session.
The transition can happen without breaking compatibility.

From a user perspective, nothing changes:

SSH still connects,
HTTPS still works,
the difference is entirely under the hood.

Hybrid approach in OpenSSH

Instead of fully switching overnight, OpenSSH uses a hybrid approach:

a classical algorithm (e.g., X25519),
combined with a post-quantum one (e.g., ML-KEM).

The final shared secret depends on both.

This provides protection in both scenarios:

if quantum computing progresses slowly, classical cryptography remains sufficient,
if it advances quickly, the post-quantum component is already in place.

Uncertainty is the key factor

No one knows when practical quantum computers will arrive:

possibly decades from now,
possibly sooner than expected.

Cryptography does not work well with “wait and see.” Transitions must happen in advance.

Conclusion

The OpenSSH warning is not about a failure – it reflects a shift in assumptions. The Internet is not reacting to broken cryptography. It is preparing for the possibility that it could be broken. That is why the transition to post-quantum cryptography is already underway – long before it becomes strictly necessary.

Looking further ahead

It is entirely possible that post-quantum cryptography is not the final stop, but just another transition.

History suggests that every “hard” problem in cryptography eventually becomes tractable under a new computational model. Today, lattice-based schemes are believed to resist quantum attacks—but that belief is based on current knowledge, not a proven limit. A sufficiently advanced generation of quantum algorithms, or entirely new computational paradigms, could challenge even these assumptions.

If that happens, we may face a world where secure key exchange becomes fundamentally harder—or temporarily impossible—forcing a redesign of how trust and confidentiality work on the Internet.

So the real question is not whether we are safe today. It is this:

What happens if quantum computing continues to advance beyond our current expectations?
Which direction will it take and how quickly?
And if our assumptions fail again, are we prepared for a scenario where large parts of the Internet – from banking to private communication – can no longer rely on encryption at all?