An easy tutorial to understand basic encryption by analyzing how a quantum computer can break it. Using free tools, this should take less than 20 minutes.

What to Know Before You Begin

In an earlier article, I described how and why quantum computers can break encryption on the internet and the subsequent roll-out of new, post-quantum cryptography, as a defense mechanism. This article is designed to be an active and practical appendage to that article. Here, you will have the opportunity to experience the quantum encryption threat by examining real websites.

You do not have to be a cryptography or security expert to do this. There are no complicated steps and this can be accomplished by anyone with basic computer skills. By the end of this you should be confident your ability to critically analyze a given website and understand where its vulnerabilities to quantum attacks lie, and communicate your findings to the public in a meaningful and simple manner.

What you'll need:

  • A web browser.

  • A terminal (Command Prompt or PowerShell on Windows, Terminal on Mac/Linux)

  • That's all. Everything in this guide is free, and there is no risky software installation.

A 30-second refresher

Secure website connections (the padlock in your browser) use TLS — the protocol behind HTTPS. TLS handles two main parts of secure connections:

  1. For the first part, a server and a browser agree to use a shared secret to encrypt the rest of the session. Generally, this step has many forms of public-key cryptography. RSA and various forms of elliptict-curve cryptography (like ECDH) are most popularly used.

  2. For the second part, a shared secret is used, and the remaining session data is encrypted using a symmetric encryption scheme, like AES.

The important part for our investigation is that the first step of the connection is quantum-vulnerable. When quantum computers are functional, RSA and ECDH will bite the dust, while AES will remain practically unbreakable, and therefore quantum-safe. Because of this, when we look at a website, we are asking “How does this website perform a key exchange, and what will a quantum computer be able to do about it?”

Let's go on!

Method 1 — The easy way (browser, no tools)

Have a look at what you have on hand.

  1. Access any secure webpage, as an example, https://www.wikipedia.org.

  2. Click on the padlock icon located in the address bar.

  3. Look at the section "Connection is secure" → "Certificate details" (the wording is different based on the browser).

In the Public Key field or the Signature Algorithm, you will see something like the following:

  • RSA 2048 — encryption based on providing large numbers to the key. Quantum vulnerable.

  • ECDSA / EC (P-256) — vulnerable to the same quantum computing issue as above. Quantum-vulnerable.

What you just learned: the certificate is telling you about the public key algorithm used in the site, and right now it is almost always a quantum vulnerable one used either RSA or EC.

Method 2 — The detailed way (free online scanner)

A browser can give you some info, but a dedicated scanner can show you everything, including the key-exchange method.

  1. Go to SSL Labs' free SSL Server Test (ssllabs.com/ssltest).

  2. Enter a domain (you can use wikipedia.org or even your own page).

  3. Wait for the scan to finish, then go to the "Cipher Suites" section.

Now your entries should look similar to this one:


TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Enter fullscreen mode Exit fullscreen mode

You can decode this entry, and it contains the following information:

  • ECDHE → the key exchange is done via Elliptic-Curve Diffie-Hellman. This is the quantum step in the chain of vulnerabilities.

  • RSA → the server's authentication employs RSA. Also quantum-vulnerable.

  • AES_256_GCM → the bulk data is encrypted by AES-256. This is considered quantum-safe.

  • SHA384 → the hashing algorithm. Safe.

You can identify which quantum computer would likely breach this cipher, namely ECDHE and RSA, while which component would remain safe, namely AES-256. This is a useful skill, seeing as most people are unable to even make sense of a cipher suite.

What you just learned: the ability to read a TLS cipher suite and determine which parts are quantum-safe bulk encryption and which parts are quantum-vulnerable key exchange and authentication.

Method 3 - The hands-on way (terminal with OpenSSL)

With this method, you move from “reader” to “inspector.” OpenSSL is a free tool that is pre-installed on most Mac and Linux computers, and is available for Windows.

Find out if you have it: Open your terminal and run openssl version. If it returns a version number, you are all set. If it does not, for Windows the easiest way is to run it in Git Bash that comes with Git for Windows, or install OpenSSL for Windows.

You can now connect directly to a website’s encryption layer and see what it negotiates. Run:

openssl s_client -connect wikipedia.org:443 </dev/null

Enter fullscreen mode Exit fullscreen mode

This will print a wall of text. It may look daunting, but you should only look for a few lines that contain the following.

New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit

Enter fullscreen mode Exit fullscreen mode

And somewhere in the negotiation details, look for:

Negotiated TLS1.3 group: X25519

Enter fullscreen mode Exit fullscreen mode

Here’s how to interpret what you see.

  • Server public key is 2048 bit with an RSA certificate → is quantum authentication and is therefore vulnerable.

  • Negotiated group: X25519 → is the key-exchange method which is an elliptic-curve algorithm. This is also the prime quantum target.

  • TLS_AES_256_GCM → is quantum-safe bulk encryption.

You’ve done a security engineer’s job: you connected to a live server and found out what cryptography it’s using. You can now say, “X25519 is what a quantum computer would break first.”

What you learned: how to access a live server and find out what key-exchange group it’s using, which is the most quantum-relevant piece of information.

What "quantum-ready" would really mean

What would you hope to find as a post-quantum-ready server? A server that is post-quantum-ready does a hybrid key exchange — a combination of a traditional key exchange and a post-quantum key exchange. In a server key exchange group, this would look something like:


X25519MLKEM768

Enter fullscreen mode Exit fullscreen mode

The MLKEM is the post-quantum key exchange algorithm that is combined with the standard key exchange X25519. If you see a group like this, you are looking at a server that is starting to defend against quantum computing.

Try this: run Method 3 against a few of the bigger company’s domains (in this case, a Cloudflare-securing domain). See what you find. Some will only support X25519, while others will support the new hybrid MLKEM. That difference is the entire migration, happening in real time, visible to you in one command.

You now have a simple, repeatable way to determine any website's quantum exposure.
1) Browser padlock. Check the certificate's public key algorithm. RSA / EC = vulnerable.
2) SSL Labs scan. Check cipher suites and find the key exchange method.
3) OpenSSL. Check the group set for key exchange.
4) Look for a hybrid 'MLKEM' group. That's a quantum-ready server.
Try it on your website, your employer's website, and your bank's website. You'll discover the same thing that the security teams are facing. Almost everything is quantum vulnerable, and the post-quantum migration has only just started.

Why this matters and how to apply it

The first step in solving a problem is knowing how to identify it. Running this audit and finding only classical algorithms (which you will almost always find) means you can use the following guidance:

  • It’s not an emergency, but it’s a deadline. Data protected by these algorithms can be obtained and stored for future use when quantum computers become available (this is referred to as "Harvest Now, Decrypt Later").

  • Monitor your vendors. Ask if the services you depend on have plans to post-quantum migrate. A number of large providers already have plans in place.

  • Look for hybrid key exchange in the tools, browsers, and servers you use. This will provide evidence that the upgrades are being implemented.

Overall, quantum computing will not be able to break the internet as it is being adjusted. Now you don't just know it's happening, you're able to prove it on every site in under five minutes!