up:: Migration Architecture MOC
Layered Encryption and Post-Quantum Risk
Layered encryption is when a single message is wrapped by several independent cryptographic layers on its way across a network, and its post-quantum risk does not add up the way most people expect. Confidentiality and authentication compose by opposite rules. One quantum-safe layer anywhere in the stack keeps the message payload confidential, even if every other layer is breakable, but authentication stays quantum-broken until every public-key layer is migrated. That single asymmetry decides which layer you fix first, and it is why “just add post-quantum crypto everywhere at once” is the wrong plan.
Source: Ashish Kundu, Vishal Chakraborty, Ramana Kompella, “Post-Quantum Cryptographic Analysis of Message Transformations Across the Network Stack,” arXiv:2604.08480, 2026, arxiv.org/abs/2604.08480.
The short version:
- A message crossing a real network is nested encryption. The Wi-Fi layer wraps a VPN, which wraps TLS, which wraps an end-to-end app layer, so an attacker has to peel every layer to reach the plaintext.
- Confidentiality is protected by the strongest layer. One quantum-safe layer makes the whole chain safe for the payload, because the attacker who breaks everything else still cannot open that layer.
- Authentication is only as strong as the weakest layer. Each layer authenticates a different party on its own, so breaking any one public-key layer lets an attacker impersonate that party and sit in the middle at that layer.
- Metadata leaks inward to the first safe layer. Breaking the outer layers reveals their headers, who is talking to whom and when, down to wherever the peeling stops.
- More layers is not more quantum safety. Layer count never enters the math. Three breakable layers are as exposed as one. What matters is whether a layer is quantum-safe and where it sits.
- Sequence by objective: for the payload, one well-placed quantum-safe layer; for metadata, the outermost layer first; for authentication, every public-key layer with no shortcut.
What is layered encryption?
Layered encryption is the everyday reality that traffic is protected by more than one cryptographic layer at once, each operating independently and each wrapping the output of the layer above it. Send an iMessage from a coffee shop and the same message is protected four times over: Wi-Fi encryption on the local link, possibly a corporate VPN across the network, TLS to the relay servers, and Apple’s PQ3 end-to-end encryption between the two phones. Every layer runs its own key exchange, its own authentication, and its own bulk encryption.
Think of it as a gift box inside a gift box inside a gift box. To reach the innermost gift, you have to open every box in order. That nesting is what gives layered encryption its surprising post-quantum behavior, because “how safe is the whole stack?” turns out to be two separate questions with two opposite answers, one for keeping the contents secret (confidentiality) and one for knowing you are really talking to who you think you are (authentication).
Why does one quantum-safe layer protect the payload?
Because reading the payload requires breaking every layer, so a single unbreakable layer stops the whole attack. The nesting means the attacker faces an AND condition: peel the Wi-Fi, then the VPN, then TLS, and only then the app layer. If any one of those layers uses a quantum-safe key exchange, the attacker who has broken everything above it is left holding a box they cannot open. The contents stay secret.
Chain confidentiality is set by the strongest layer, the maximum. In the paper’s iMessage example, the outer Wi-Fi and TLS layers are both breakable by a future quantum computer, but PQ3 at the app layer uses Kyber (ML-KEM), which Shor’s algorithm does nothing against. A quantum adversary who cracks Wi-Fi and TLS recovers only the sealed PQ3 ciphertext, so the message content stays confidential. The useful conclusion for a real migration is that you can reach quantum-safe confidentiality for a sensitive payload by placing one strong layer well, rather than by moving the entire stack.
Why does authentication need every layer migrated?
Because authentication is the mirror image: breaking any one layer is enough, so the whole chain is only as strong as its weakest link. Each layer authenticates a different party. The Wi-Fi layer vouches for the access point, TLS vouches for the relay server, and the app layer vouches for the sender. These are separate trust relationships. A quantum adversary who recovers the private key behind any one layer’s certificate can impersonate that one party and slip into the middle at that layer, and doing so leaves the other layers’ authentication untouched. A quantum-safe access point does nothing to stop a forged server certificate one layer down.
Chain authentication is set by the weakest layer, the minimum. If any public-key signature or certificate in the path is quantum-broken, the chain’s authentication is quantum-broken. The paper checked this across every scenario and found that no layer used a post-quantum signature: even PQ3 signs with classical elliptic-curve ECDSA, so every stack it studied was quantum-safe for confidentiality yet quantum-broken for authentication at the same time. There is no clever single-layer fix for authentication the way there is for confidentiality. It has to be finished across every layer, and it waits on standardized post-quantum signatures like ML-DSA and SLH-DSA actually shipping in each protocol.
How much metadata still leaks?
The payload goes safe the moment the peeling reaches a quantum-safe layer, but everything the attacker opened on the way in is exposed. Each outer layer they break reveals one more envelope of headers: addresses, server names, timing, packet sizes, the plain fact that this device is talking to Apple’s servers at a given minute. An inner quantum-safe layer cannot hide the headers of the layers wrapped around it, because those were already read.
So metadata leaks inward from the outside and stops at the first quantum-safe layer, and the position of that layer sets how much leaks. This is why “is the message safe?” and “is it safe who I am talking to and when?” are different questions. A system that only cares about the contents is happy with one strong inner layer. A system where the pattern of communication is itself sensitive, which is often true in finance, health, and anything touching sources, cares a great deal about making an outer layer safe so the headers beneath it never get read.
Does adding more encryption layers help?
No. Layer count never appears in how the risk composes. Confidentiality is the strongest layer and authentication is the weakest layer, and both depend only on the extreme, never on the number of layers. Three quantum-breakable layers leave the payload exactly as exposed as one, because a quantum adversary opens all three. Stacking more breakable encryption is effort without protection.
The paper puts it plainly: more layers give no better quantum security. In its study, the worst case and the best case both had three active layers, and the only difference was whether one of those layers was quantum-safe and where it sat. Classic defense in depth still earns its keep against ordinary attackers and for metadata, so layering stays worthwhile; the narrow correction is that depth by itself buys no quantum safety. Against a quantum computer, depth buys nothing unless at least one layer is genuinely quantum-safe.
Which network layer should you migrate first?
It depends on which of three outcomes you are buying, and each points at a different layer:
| Your goal | Migrate this layer first | Why it works |
|---|---|---|
| Keep the payload secret | Any one inner layer with a strong post-quantum key exchange, such as app-layer end-to-end encryption | One quantum-safe layer takes the whole chain to safe for the payload, the cheapest route to protecting the data |
| Keep the metadata private | The outermost layer, such as the link or VPN | Leakage stops at the first safe layer counting inward, so a safe outer layer shields the headers of everything beneath it |
| Trust who you are talking to | Every public-key layer, with no ordering trick | Authentication is the weakest layer, so a partial migration stays broken until the last layer moves |
For a harvest-now-decrypt-later worry about a sensitive payload, the fastest win is a single well-placed quantum-safe layer on that payload. Where traffic patterns are themselves sensitive, the priority flips toward the outermost layer. Authentication is the long pole of the three: it cannot be sequenced cleverly, only completed. Any roadmap that treats “add post-quantum crypto” as one undifferentiated task will mis-sequence the work, because the confidentiality half is a placement problem and the authentication half is a completeness problem. This is a core reason migrations run long, a pattern the stall analysis returns to.
The trap where a stronger protocol is quantum-weaker
One counterintuitive corner is worth flagging for planners: a setting that is stronger against ordinary attackers can be weaker against a quantum one, and harder to fix. The paper’s Wi-Fi comparison found that WPA2-Personal is only dented by Grover’s algorithm and needs a mere configuration change, while WPA2-Enterprise is fully broken by Shor’s algorithm and needs a protocol replacement. The enterprise-grade option, the one a hardening guide tells you to prefer, is the quantum-weaker of the two and the costlier to remediate. Quantum posture has to be judged per algorithm and never inferred from a protocol’s classical reputation, so “upgrade to the newest, strongest classical option” is not a safe stand-in for post-quantum readiness.
Common misconceptions
- We route everything through a VPN, so we are covered. The VPN protects the payload only if its own key exchange is quantum-safe, for example WireGuard with a pre-shared key mixed in. A classical VPN wrapping classical TLS is two breakable layers, and the payload is exposed.
- More encryption layers mean more quantum safety. Layer count does not enter the risk at all. Only the presence and position of a quantum-safe layer matters.
- If our confidentiality is quantum-safe, our authentication must be too. The opposite composition rules mean a stack can be safe for the payload and broken for authentication at the same time, which is exactly what the paper found for iMessage.
- Post-quantum encryption hides our metadata. A safe inner layer protects the payload while the headers of every outer layer stay exposed once those outer layers fall.
Questions people ask
Does one post-quantum layer really protect the whole message? For the confidentiality of the payload, yes, as long as that layer’s key exchange is genuinely quantum-safe and it sits inside the layers an attacker would otherwise read. The outer layers can be broken and the payload still cannot be opened.
Then why migrate the other layers at all? For metadata and for authentication. Outer layers protect who is talking to whom, and authentication is only as strong as the weakest layer, so both need more than a single inner fix.
Is a VPN enough to be quantum-safe? Only if the VPN’s key exchange is itself post-quantum. A classical VPN is one breakable layer, so a quantum adversary peels it like any other. It helps against many threats today, and against a quantum computer it protects the payload only when its own cryptography is quantum-safe.
Is this an argument against defense in depth? No, it is a caution against assuming depth equals quantum safety. Layers still matter against ordinary attackers and for metadata. They just do not add up against a quantum adversary the way people assume.
How do I turn this into a plan? Split the work into three goals, payload confidentiality, metadata, and authentication, then sequence each by its own rule: one inner layer, the outermost layer, and every layer respectively. See Start a Migration and Mosca’s Theorem for how that folds into a full roadmap.
Which is harder to fix, confidentiality or authentication? Authentication, by a wide margin. Confidentiality can be solved by placing one strong layer, while authentication cannot be solved until every public-key signature and certificate along the path has moved to a post-quantum scheme.
Everything here is the map, given freely. When your team needs its own layered systems sorted into what already resists a harvesting quantum adversary and what still has to move, that’s a working session with your team.
Last verified 2026-07-27 · Updated 2026-08-25 · Maintained by Addie LaMarr, LaMarr Labs.