Quantum-Era Attacks: Microsoft Warns Organizations to Expand Threat Modeling

Microsoft is warning organizations to expand their threat-modeling exercises to prepare for potential quantum-era attacks. The company's researchers, Michael Howard and Simone Curzi, argue that organizations must determine where cryptography is used, what information it protects, and whether the underlying technology can be upgraded without major architectural changes.

The transition to post-quantum cryptography (PQC) requires more than replacing a few encryption algorithms. Automated scanning tools may overlook controls supplied by operating systems, cloud platforms, third-party frameworks, and hardware, which is why threat modeling is essential in uncovering cryptographic dependencies.

Teams should record the algorithms, protocol versions, cipher suites, key sizes, and implementation providers used by each component, as well as who owns each cryptographic dependency and how long protected data must remain confidential. Microsoft has provided a list of questions for organizations to add to their existing threat-modeling reviews, including whether RSA or elliptic-curve cryptography is used for key exchange or digital signatures.

Microsoft's guidance recommends TLS 1.3 as the required foundation for post-quantum network protection, but simply using TLS 1.3 does not make a connection quantum-resistant. The company recommends organizations move from RSA, ECDH, and Diffie-Hellman key establishment to ML-KEM and use AES-256 for bulk encryption.