VentraIP urges sites to prepare for quantum encryption

VentraIP has urged website owners to prepare for post-quantum encryption on the web as browsers and internet infrastructure providers begin introducing quantum-resistant methods.

The shift centres on how websites secure connections through HTTPS, the system behind the padlock icon in a browser address bar. That protection has long relied on encryption methods based on mathematical problems that would take conventional computers an impractically long time to solve.

Quantum computing has raised concerns about part of that model, particularly public-key cryptography, which helps browsers and websites agree on secret keys. In theory, a sufficiently powerful quantum computer could break some of the encryption methods widely used on the internet today, though current machines cannot do so at the necessary scale.

Why it matters

The warning reflects a broader industry shift rather than a sudden technical break. Security planners have focused on the risk that attackers could capture encrypted traffic now and decrypt it later if quantum computers become powerful enough to crack older algorithms.

This "harvest now, decrypt later" scenario has become one of the main reasons for early migration. Data with a long useful life, including health records, financial information, business plans and personal communications, could remain sensitive for years after it is first transmitted.

Governments and security agencies have already begun setting timetables for retiring vulnerable cryptographic systems, with many targeting changes in the 2030s. Replacing encryption across the internet is expected to take years because browsers, servers, software libraries, certificate systems and hosting infrastructure all need to support newer standards.

Standards emerge

A major step came when the US National Institute of Standards and Technology published its first finalised post-quantum cryptography standards after a long international selection process. VentraIP identified ML-KEM as the main key exchange standard designed to withstand attacks from both conventional and quantum computers.

Browser makers and large internet service providers have already begun deploying hybrid key exchange systems. These combine a traditional algorithm with a post-quantum method so that if either remains secure, the connection stays protected.

VentraIP said support for this approach is now appearing in Google Chrome and other major browsers, while large content delivery networks have enabled related protections across their services. Messaging platforms including Apple's iMessage and Signal have also added post-quantum protections to their encryption systems.

Hosting focus

For website owners, the practical issue is whether their servers can support the newer methods when users' browsers try to connect. If both the browser and server support post-quantum or hybrid key exchange, the session can upgrade automatically. If the server does not, the connection falls back to older encryption.

That means hosting providers and infrastructure operators are likely to play a central role in the transition. Site owners do not need to redesign websites or master cryptography, but they do need to know whether their host is keeping encryption standards current.

VentraIP pointed to Transport Layer Security 1.3 as a basic requirement because it provides the foundation for newer key exchange models used in web encryption. It advised operators to ask hosting providers whether they already support hybrid post-quantum key exchange or have a timetable for doing so.

Server maintenance is another factor. Post-quantum support is typically introduced through software updates to the systems that handle encrypted connections, so servers running outdated software could miss the transition even if website content itself remains unchanged.

VentraIP also highlighted the importance of automated certificate renewal, noting that certificate systems are expected to evolve as the post-quantum transition progresses. Sites behind content delivery networks should also verify what level of encryption support those services provide, because they may manage the secure connection seen by visitors.

Data decisions

VentraIP also urged website owners to review the kinds of data they collect and store. Sites handling sensitive or long-lived information face a greater risk from intercepted traffic that may be deciphered years later, and reducing unnecessary data collection could limit that exposure.

The wider principle is "crypto agility", or the ability to replace encryption methods without major disruption. In practice, websites running on modern, actively maintained infrastructure are likely to have an easier path than sites dependent on neglected or ageing server environments.

The transition is likely to be largely invisible to users because web pages and browser indicators will look much the same, even as the mathematics underpinning secure connections changes.

For site owners, however, the message is more immediate: encryption standards are beginning to change now, while the data moving across the internet today may need to remain protected for many years.