No single peer can fully verify post-quantum security delivery
Nothing Breaks: No Single Peer Can Soundly Gate Post-Quantum Delivery
Cryptography and Security
Summary
The authors found that it's impossible for a single computer or device to reliably confirm whether a connection is truly protected against future quantum computers. Different security tools or clients have capabilities that don’t completely cover each other, so checks by individual devices miss some risks. They also show that flaws go unnoticed because services keep running and tests pass even when quantum protections are removed. This means current methods cannot catch or signal some types of post-quantum security downgrades.
What this means in practice
- •For network security teams: Monitor and verify post-quantum security cannot rely on any single peer’s checks, prompting multi-peer or systemic solutions to detect downgrades.
- •For protocol developers: Design quantum-safe communication protocols that acknowledge gaps in current verification capabilities and incorporate broader trust models beyond single peers.
Authors
Yunze Han
Abstract
Post-quantum protection is delivered to a peer, not declared in a file: whether a session is quantum-resistant is a relation between a server's configuration and the clients that reach it. We show that no single peer can soundly gate that relation. Shipped SSH clients are not ordered: two of their post-quantum capability classes are minimal and incomparable, so a check pinned to either misses the other family's withdrawal. A peer taking both fares no better: it falls back and misses both, or, where classical outranks one family, catches just that one. No case flags both. Nothing above the wire carries the relation either. An artifact-side instrument cannot encode it, because a peer population is not one of its inputs; and across seven configurations on two protocols we find that not one of the five scalars deployed auditors expose to automation moves, while unrelated degradation moves the ones that discriminate at all: the auditors do compute the delivered algorithm, and discard it at the interface automation reads. Nothing else catches the loss either, because nothing breaks: removing a hybrid key exchange starts the daemon, validates the configuration, passes the tests and serves the client, and the adversary it defends against does not exist yet, so no functional signal can carry the loss even in principle. We then show that agents make that state reachable at scale, driving a validated downgrade in 40 of 40 episodes from ordinary engineering prose, against 0 of 40 on a matched neutral document.