Your Backup Archives Are HNDL Targets: A Quantum Safe Guide

The Problem Nobody Talks About

Every organization's cold-storage backups (tape archives, cloud S3 Glacier, Azure Archive Storage, offsite immutable backups) are encrypted with whatever scheme was current when the backup was made. For most backups older than 2024, that means RSA-2048 for key encryption and AES-256-GCM for bulk. AES-256 is fine; the RSA-wrapped keys are HNDL targets.

Practical Attack Scenario

1. Adversary breaks into a cloud provider or obtains leaked backup volumes.
2. They cannot read the data today because AES-256 is unbroken.
3. They store the volumes.
4. When CRQC arrives (2030-2040 per GRI 2025), they break the RSA key wrapping and decrypt.

The Re-Encryption Plan

1. Inventory: identify backups older than 6 months using classical key wrapping.
2. Prioritize: rank by data sensitivity and retention length.
3. Re-encrypt: unwrap classical keys, rewrap with hybrid ML-KEM.
4. Rotate: generate fresh PQ data encryption keys, re-encrypt source data where feasible.
5. Verify: cryptographic hash chain to ensure no data loss.
6. Retire: destroy old key material.

Practical Tools

• QNSQY for cold-storage PQC re-encryption with ML-KEM hybrid.
• AWS KMS PQC for new key wrapping (ML-KEM hybrid TLS available).
• Azure Key Vault PQC roadmap is rolling through 2026-2027.
• Self-hosted: OpenSSL 3 with oqs-provider for bespoke re-encryption pipelines.

Common Mistakes

• Re-encrypting headers but not the underlying data encryption keys.
• Leaving the classical key online where an HNDL adversary already has a copy.
• Re-encrypting backups on infrastructure with classical TLS that is itself HNDL-compromised.
• Assuming cloud provider "server-side encryption" protects against HNDL (it does not unless the provider has migrated its own KMS).

Frequently Asked Questions

Are S3 Glacier backups HNDL-vulnerable?

Depends on key wrapping. AWS KMS is progressively enabling ML-KEM hybrid, but older KMS CMKs or customer-managed key wrapping may still use classical algorithms.

Is AES-256 enough for backups?

AES-256 data encryption is quantum-safe. The vulnerability is in the key wrapping (how the AES key is protected). If your KMS uses RSA-wrapped AES keys, HNDL can extract the AES key.

How urgent is backup re-encryption?

For backups with multi-decade retention (financial, healthcare, legal, pharma), urgent. Start inventory now and plan a multi-year re-encryption project.

Can I just keep old backups offline?

Offline storage doesn't help if the adversary has already exfiltrated the encrypted volumes. Assume exfiltration has occurred for any organization of interest to nation-state SIGINT.

Sources

1. AWS KMS PQC
2. NIST IR 8547

Related Articles

• HNDL
• HNDL and Cables
• Hybrid Migration Playbook
• PQC for Finance
• Implementing PQC