ExpressVPN has added “post-quantum protection” to its VPN service. ExpressVPN’s proprietary Lightway protocol now includes post-quantum protection by default.
Security experts have since warned that quantum computers would render current cryptography standards — including those used by VPNs — obsolete. While the technology is still evolving and quantum computers are not yet commercially available, ExpressVPN said it decided to take steps to stay “ahead in the ever-evolving landscape of cyber threats.”
“We believe that by playing an active role in the transition to a quantum-safe world, we can future-proof ourselves and our users,” ExpressVPN said in a blog post on Oct. 23.
ExpressVPN users can update their apps to the latest version of the software to enjoy post-quantum protection via the Lightway protocol.
‘Store Now, Decrypt Later’ Attacks
Cybercriminals are using a “Store Now, Decrypt Later” strategy, where they steal encrypted data with the intention of decrypting it when quantum computers are widely available, ExpressVPN explained.
In response to these threats, ExpressVPN decided to implement post-quantum security — specifically P256_KYBER_LEVEL1 for UDP and P521_KYBER_LEVEL5 for TCP. This quantum-safe algorithm is backed by leading institutions, including the National Institute of Standards and Technology (NIST).
“We acknowledge that post-quantum cryptography algorithms, while promising, are still relatively uncharted waters, especially when compared with classical cryptographic algorithms that have enjoyed decades of extensive scrutiny and real-world testing,” ExpressVPN said.
By integrating wolfSSL and the Open Quantum Safe team’s liboqs, “we’ve ensured that our security strategy doesn’t solely rely on post-quantum algorithms,” the VPN provider explained.
A Future-Proof Security Standard
Quantum computers are very different from regular devices. They can solve complex mathematical problems, allowing them to crack the encryption we use today.
In May, the White House issued a national security memorandum outlining policies and projects related to quantum computing and urging U.S. agencies to switch to quantum-resistant cryptography to fend off quantum attacks.
ExpressVPN is one of the first VPN providers to add post-quantum protection. Other tech companies are already tapping quantum into technology. For instance, Google’s Chrome browser already uses quantum-resistant encryption. Meanwhile, NordVPN told VPNOverview that they have several plans involving quantum technology and generative artificial intelligence.
Take a look at IBM’s vision of quantum technology in the next decade:
For more news, follow us on X (Twitter), Threads, and Mastodon!
