Cisco Upgrades Routers with Quantum-Safe Certificates

Cisco has made significant progress in its efforts to make its routers quantum-safe. The latest development involves swapping pre-shared keys (PSK) for ML-DSA certificates, a key step towards achieving this goal.

The use of PSKs for authentication is not scalable and can be vulnerable to attacks, especially at larger scales. To address this issue, Cisco has implemented ML-DSA certificates on its routers.

The process involves generating the certificates on a workstation using OpenSSL 3.5+ and importing them as PKCS#12 bundles into the router. The bundle contains the private key, certificate, and issuing CA chain.

Cisco measured the size of the certificates and found that ML-DSA-65 public keys are significantly larger than RSA-2048 or ECDSA P-256 keys, with a certificate carrying it being 5,647 bytes compared to 920 bytes for RSA-2048. This could impact IKEv2 performance.