IKEv2 Post-Quantum Preshared-Key Mixing — draft-ietf-ipsecme-qr-ikev2#
IETF 122 (Bangkok) digest Program Adjacent pick Bangkok · 15–21 March 2025
- Tier: Adjacent
- Why: "Harvest now, decrypt later" is a specific concern for anyone running long-lived IPsec VPN tunnels today; this is the near-term mitigation available before full PQ key-exchange support lands in IKEv2.
- What: Extends IKEv2 to resist a future quantum computer by mixing preshared keys into the key derivation, without waiting for quantum-secure key-exchange algorithms to be standardized and deployed in IKEv2 itself. (from abstract only)
- How: A PSK, distributed out-of-band, is mixed into the IKEv2-derived key material so that breaking the classical Diffie-Hellman exchange alone isn't sufficient to recover session keys.
- Where applicable: General IPsec/IKEv2 deployments wanting a stopgap against harvest-now-decrypt-later before native PQ key exchange in IKEv2 matures.