P-256 ECDH between mobile and TEE is vulnerable to quantum attacks #1315
Description
The current key exchange between the mobile SDK and proving server (TEE) uses P-256 ECDH, which is vulnerable to quantum computer attacks (using Shor's algorithm). This creates a "harvest now, decrypt later" risk where an adversary could record encrypted traffic today and decrypt it once quantum computers become available.
The solution I would propose is to implement PQXDH (Post-Quantum Extended Diffie-Hellman), following Signal's specification. This uses a hybrid approach combining the classical X25519 ECDH and the post-quantum ML-KEM-768 (Kyber). This protocol has recently been formally verified.
This hybrid design provides defense in depth: an attacker would need to break both X25519 and ML-KEM-768 to recover the session key.