Suppose today I'm designing a new application that will employ asymmetric cryptography to allow users to securely exchange data with one another. As far as I can tell there are no quantum-safe algorithms yet generally accepted, let alone that are ready to be used in production. (Please correct me if I'm wrong!) Thus I'm assuming I'm still looking at RSA as the gold standard. Estimates for when RSA can be cracked vary from 5 to 15 years or more. 15 years doesn't bother me too much, but 5 years does, especially for a new application.
So, if I'm starting from scratch, what would be considered the best practices to be as prepared as possible for a post-quantum world? And to explain what I mean by prepared, I don't simply mean ready to change algorithms, but rather to best ensure that data transmitted today won't be vulnerable in the future.
Two things I've considered -
- Using 4096-bit keys. However I don't see a consensus on whether this actually makes much of a difference even for classical attacks, let alone quantum ones.
- Keeping public keys effectively private. My idea here is to keep even public keys within the confines of the secure application servers and unavailable to users. We would not allow clients to encrypt or verify sender signatures directly, but rather servers would hold public keys as closely as they hold their other secrets. Encrypting and verifying signatures would thus require client API calls.
I'm wondering if these ideas add any genuine security value, or if not why not, and if there are other measures that experts would recommend at this time to architect a new application to be as resilient as possible to the so-called quantum apocalypse.