Quantum-Resistant Wireless Communications

An apparatus, comprising:

• one or more network interfaces;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process when executed configured to:
• determine, by a key management service executed by the apparatus, cryptographic capabilities of a wireless client and an access point in a wireless network;
• select, by the key management service, a post-quantum cryptographic key generation approach for use by the wireless client and the access point based on their cryptographic capabilities;
• generate, by the key management service, a key exchange policy for the wireless client and the access point that specifies one or more out-of-band paths that differ from a Wi-Fi link between the wireless client and the access point;
• and
• cause, by the key management service, the wireless client and the access point to perform a key exchange to associate the wireless client with the access point in the wireless network in part by generating keys using the post-quantum cryptographic key generation approach and exchanged via the one or more out-of-band paths specified by the key exchange policy.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

• determining, by a key management service executed by the device, cryptographic capabilities of a wireless client and an access point in a wireless network;
• selecting, by the key management service, a post-quantum cryptographic key generation approach for use by the wireless client and the access point based on their cryptographic capabilities;
• generating, by the key management service, a key exchange policy for the wireless client and the access point that specifies one or more out-of-band paths that differ from a Wi-Fi link between the wireless client and the access point;
• and
• causing, by the key management service, the wireless client and the access point to perform a key exchange to associate the wireless client with the access point in the wireless network in part by generating keys using the post-quantum cryptographic key generation approach and exchanged via the one or more out-of-band paths specified by the key exchange policy.