If AES falls to the Möbius Bridge, what replaces it? The answer: post-quantum cryptography standards that were already being developed, and symmetric alternatives that aren't affected.
Why "Post-Quantum"?
The term "post-quantum" refers to cryptographic algorithms designed to resist attacks from both classical computers AND quantum computers. While the Möbius Bridge is reportedly a classical (non-quantum) attack, the post-quantum standards also happen to use fundamentally different mathematical foundations than AES.
The Replacements
ML-KEM (Kyber) — Key Exchange
ML-KEM (Module-Lattice Key Encapsulation Mechanism), previously known as CRYSTALS-Kyber, handles secure key exchange — the process by which two parties agree on a shared secret over an insecure channel.
- Mathematical basis: Lattice-based cryptography (Module Learning with Errors)
- Status: NIST finalized standard (FIPS 203) as of August 2024
- Already deployed in: Chrome (since 2024), Safari, Signal (PQXDH), iMessage (PQ3), Cloudflare
ML-DSA (Dilithium) — Digital Signatures
ML-DSA (Module-Lattice Digital Signature Algorithm) verifies that messages, software updates, and certificates haven't been tampered with.
- Mathematical basis: Also lattice-based (Fiat-Shamir with Aborts)
- Status: NIST finalized standard (FIPS 204)
- Being integrated into: TLS certificates, code signing, document signing
ChaCha20 — Symmetric Encryption (AES Alternative)
ChaCha20 is not a post-quantum algorithm — it's a symmetric cipher that was already widely deployed as an alternative to AES. Critically, it uses a completely different design:
- AES: Substitution-Permutation Network (SPN) — what the Möbius Bridge attacks
- ChaCha20: Addition-Rotation-XOR (ARX) — structurally unrelated
This means the Möbius Bridge, which exploits SPN-specific properties, does not apply to ChaCha20. Many systems already support ChaCha20-Poly1305 as a TLS cipher suite.
Who's Already Migrating
| Company | What They've Done |
|---|---|
| Google Chrome | ML-KEM in TLS since 2024, default for new connections |
| Apple | PQ3 protocol in iMessage (ML-KEM + classical hybrid) |
| Signal | PQXDH key agreement protocol deployed |
| Cloudflare | Post-quantum TLS support for all customers |
| AWS | Post-quantum TLS support in SDKs |
| Microsoft | Post-quantum support in SymCrypt library |
The Hybrid Approach
Most deployments use a "hybrid" approach: combining classical cryptography with post-quantum cryptography. This way, even if the post-quantum algorithms have undiscovered weaknesses, the classical layer provides a fallback (and vice versa).
For example, Chrome's implementation combines X25519 (classical elliptic curve) with ML-KEM (post-quantum lattice) for key exchange. An attacker would need to break BOTH to compromise the connection.
What You Can Do Now
- Update your browsers — Chrome, Firefox, and Safari ship post-quantum support automatically
- Choose services that support ChaCha20 — look for ChaCha20-Poly1305 in VPN and encrypted storage settings
- Check your VPN's cipher suite — switch to ChaCha20 if your provider offers it
- Use VeraCrypt with ChaCha20 for local disk encryption instead of AES mode
The migration from AES is a marathon, not a sprint. But the finish line is well-defined, and the first mile has already been run.
Not sure where your defenses stand? Take the free assessment for a personalized analysis.