Why Your Encrypted Email Is Already Exposed to Harvest Now Decrypt Later

Every Hop Is Classical Today

Email traverses multiple hops: MX servers, relays, spam filters, archival systems, and finally the recipient. Each hop uses TLS, mostly TLS 1.2 or classical TLS 1.3 without hybrid ML-KEM. S/MIME and PGP add end-to-end encryption but rely on RSA-2048, ECDH, or ECDSA for key transport and signatures. Every layer is HNDL-vulnerable.

The Three Vulnerable Layers

1. SMTP/STARTTLS: classical TLS between mail servers. Adversary records traffic, decrypts once CRQC arrives.
2. S/MIME key wrapping: uses RSA to wrap the AES content key. Classical RSA broken by Shor.
3. PGP/GPG: RSA, ElGamal, ECDH all classical. Same vulnerability.

The Path Forward

• Email providers: deploy hybrid TLS 1.3 (X25519MLKEM768) between servers.
• S/MIME: IETF draft work adds ML-KEM to S/MIME. Production timelines 2026-2027.
• OpenPGP: IETF PQC drafts maturing; GnuPG support expected 2026-2027.
• Modern alternatives: Signal, iMessage PQ3, Wire already ship hybrid PQC.

Operational Advice

1. For sensitive content, prefer end-to-end PQC messaging over email.
2. Encrypt attachments separately with a PQC-aware tool before sending.
3. When emails must be archived, encrypt archives with Post Quantum Cryptography before storage.
4. Track S/MIME and OpenPGP PQC draft progress in IETF.

Frequently Asked Questions

Is Gmail S/MIME quantum-safe?

Gmail S/MIME uses classical RSA and ECC. Gmail TLS between servers uses hybrid ML-KEM progressively through 2024-2026. End-to-end via S/MIME remains classical until IETF drafts finalize.

Should I stop using email for sensitive data?

For multi-decade sensitive content, prefer PQC-native channels (Signal, iMessage PQ3). For email, encrypt attachments with PQC tools before sending.

Does ProtonMail use PQC?

Proton has announced research into PQC. Production default PQC in ProtonMail is in progress but not guaranteed across all deployments as of April 2026.

What about encrypted mailing lists?

Mailing lists using classical OpenPGP are HNDL-vulnerable. Migrate to OpenPGP PQC once drafts finalize, or use modern PQC messaging.

Sources

1. IETF OpenPGP WG
2. Signal PQXDH

Related Articles

• PGP vs PQC
• HNDL
• HNDL Enterprise Threat Model
• HNDL and Backups
• TLS PQC