QuantumLock Overview

QuantumLock was previously called DoubleLock.

Introduction

Secret Server's QuantumLock is a feature that provides an additional security layer by protecting secret data using asymmetric encryption (a public/private key pair) where the private key is protected by a human-generated password. This feature is independent of regular Delinea permissions, Secret Server login access, or physical access to the machine running Secret Server.

A shortcut way of thinking about QuantumLocks is as an extra password for secrets that is held by a set group of users. In addition, both the password and the group of users are reusable for other secrets. QuantumLocks also future-proof your most sensitive static secrets against the advancing capabilities of quantum computing.

QuantumLock is an upgrade of the earlier DoubleLock feature. Besides the name change, the difference is that QuantumLock offers the option to use a post-quantum algorithm to protect the key that encrypts the secret data. That algorithm is ML-KEM-1024, the Module-Lattice-Based Key-Encapsulation Mechanism standardized by NIST in FIPS 203. ML-KEM was standardized from the CRYSTALS-Kyber submission, so earlier documentation, release notes, and the Secret Server user interface refer to the same algorithm as Kyber or Kyber-1024. The option is designed to counter the potential threat from quantum computers to current encryption methods. That threat is closer than you might think—"harvest now, decrypt later" attacks steal encrypted data now for later decryption by quantum computers.

How the pieces fit together: each QuantumLock user has an asymmetric key pair (RSA-2048 by default, or ML-KEM-1024 when Quantum Safe Encryption is enabled). The user's private key is encrypted with a key derived from the user's QuantumLock password. The user's public key wraps (encapsulates) the QuantumLock's AES-256 symmetric key, and that symmetric key encrypts the secret data. This two-step process (key encapsulation followed by symmetric encryption) applies the strengths of both asymmetric cryptography (for secure key exchange) and symmetric cryptography (for efficient encryption of the data itself). See QuantumLock Objects and Relationships.

Today's asymmetric-key encapsulation methods, such as RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography), rely on the difficulty of solving mathematical problems, such as factoring large numbers or solving discrete logarithms, with classical computers. However, quantum computers, which operate on principles of quantum mechanics, could solve these problems much faster, rendering these encapsulation methods vulnerable.

Quantum-safe or post-quantum (PQ) algorithms are cryptographic methods that are believed to be secure against quantum computer attacks. They are based on mathematical problems that are considered difficult for both classical and quantum computers to solve, ensuring the security of encapsulated keys, even in the era of quantum computing. PQ algorithm types include lattice-based cryptography, hash-based cryptography, code-based cryptography, and multivariate polynomial cryptography, among others.

ML-KEM-1024 is the highest security category defined in FIPS 203. Its resistance to quantum attacks is, by design, approximately the same as AES-256's resistance to conventional computer attacks.

ML-KEM-1024 is a key-encapsulation mechanism (KEM): a key is encapsulated (encrypted) with a public key, stored or sent over an insecure channel, and then decapsulated (decrypted) with the matching private key. A symmetric algorithm, AES-256 (Advanced Encryption Standard), is used for encrypting the secret data itself because symmetric-key algorithms are faster and more efficient for large amounts of data than asymmetric-key algorithms.

You might wonder how well protected the encrypted data at rest is to quantum-computer attacks. Symmetric algorithms, such as AES, are PQ if their keys are sufficiently long, which is not an issue with their typical use cases.
ML-KEM comes in three parameter sets. ML-KEM-1024 specifically aims at security roughly equivalent to AES-256, with a private key size of 3168 bytes, a public key size of 1568 bytes, and a ciphertext size of 1568 bytes. FIPS 203 was finalized by NIST in August 2024.

Comparing RSA-2048 to ML-KEM-1024

QuantumLock without Quantum Safe Encryption enabled is essentially the same as its predecessor, DoubleLock, and relies on RSA-2048 for key encapsulation.

Comparing the encryption, decryption, and key-generation speeds of RSA-2048 and ML-KEM-1024 involves understanding the efficiency of these algorithms under practical implementations. The specific speeds can vary based on the software and hardware used for the implementation, but here is a general overview based on their cryptographic principles and typical use cases.

RSA-2048

  • Key Generation: RSA-2048 key generation is relatively slow because it involves finding two large prime numbers and calculating their product along with other related mathematical operations. This process is computationally intensive.

  • Encapsulation: RSA-2048 encryption is faster than its key generation. However, compared to ML-KEM-1024, RSA-2048 encryption is usually slower because it involves modular exponentiation, which is a heavy operation especially for large key sizes like 2048 bits.

  • Decapsulation: RSA-2048 decryption is also computationally intensive, similar to encryption, because it requires modular exponentiation. RSA decryption is generally slower than encryption due to the nature of the private key operations.

ML-KEM-1024

  • Key Generation: ML-KEM-1024 generally has faster key generation than RSA-2048. This efficiency comes from its use of lattice-based cryptography, which involves operations on vectors and matrices that are more efficient than the prime number operations in RSA.

  • Encapsulation: ML-KEM-1024 is designed for fast encapsulation operations. It uses simple arithmetic operations on small integers, making it very efficient and faster than RSA-2048 encryption.

  • Decapsulation: Like its encapsulation, ML-KEM-1024 decapsulation is also fast and efficient. The algorithm benefits from the same lattice-based operations, optimized for quick decryption times.

Summary

  • RSA-2048 is generally slower across all three operations compared to ML-KEM-1024. The difference in speed is primarily due to RSA's reliance on large prime numbers and modular arithmetic, which are computationally heavier, especially as key sizes increase to improve security.

  • ML-KEM-1024, being a post-quantum algorithm designed with efficiency in mind, uses lattice-based cryptography that allows for quicker key generation, encapsulation, and decapsulation operations. This makes it particularly suitable for environments where speed and efficiency are critical.

While ML-KEM-1024 offers advantages in speed and quantum resistance, the choice between RSA-2048 and ML-KEM-1024 (or any cryptographic algorithm) depends on the specific security requirements, computational resources, and threat models relevant to the application in question.

When to Use QuantumLock

Both ML-KEM-1024 and RSA-2048 QuantumLocks

Enabling QuantumLock (or the earlier doublelock) on any secret only grants users access if they have access to the QuantumLock and enter their QuantumLock password. Enabling QuantumLock disables the RPC features for the secret. It also prevents heartbeat. Thus, QuantumLock should not be used for secrets that require a password rotation or heartbeat check.

QuantumLock use cases include:

  • Global admin passwords

  • Root account passwords

  • Bank account passwords

  • PINs, Social Security numbers, or other personal information.

When users protect secrets with QuantumLock, only that user has access to the secret. If multiple users are in a group, members have access to the secret, but each will have their own unique QuantumLock.

Even an administrator or a user with Unlimited Vault Access privileges cannot recover a QuantumLocked secret if the user forgets his or her password. If there is a single user in a QuantumLock group and that user account is deleted, those secrets will not be accessible by anyone! Thus, we recommend adding at least two users to the group to be safe.

ML-KEM-1024 QuantumLocks

Whether to enable Quantum Safe Encryption depends on your circumstances. RSA-2048 is not known to be breakable by today's classical computers. The risk that post-quantum key encapsulation addresses is "harvest now, decrypt later": encrypted data captured today could be decrypted once a sufficiently capable quantum computer exists. Estimates of when such a computer might exist vary widely, and NIST's transition guidance targets the end of this decade for moving away from RSA and ECC key establishment. Enable Quantum Safe Encryption for secrets whose value outlives that horizon.

Quantum Safe Encryption applies ML-KEM-1024 to the key wrapping for QuantumLock-protected secrets only. It does not change how other secret data is encrypted, and it does not cover secrets that use heartbeat or password rotation, because those cannot be QuantumLocked.

Upgrading from Secret Server 11.7 through 11.9 with Quantum Safe Encryption Enabled

Secret Server 11.7 through 11.9 implemented Quantum Safe Encryption with the pre-standard CRYSTALS-Kyber algorithm. Secret Server 12.0 moved to the finalized ML-KEM standard, which is not compatible with the earlier implementation. As a result, QuantumLock-protected secrets created on 11.7 through 11.9 with Quantum Safe Encryption enabled could not be opened after upgrading to 12.0 or 12.1. Attempting to view such a secret returned an error, although the encrypted data remained intact in the database.

Starting with Secret Server 12.2.000007, these secrets are recovered automatically the next time they are viewed, whether through the user interface or the REST API. No administrator action is required to restore access.

The automatic recovery is available in 12.2.000007 and later only. It is not included in 12.0.x or 12.1.x maintenance or security releases. If you are upgrading from 11.7 through 11.9 and use Quantum Safe Encryption, upgrade to 12.2.000007 or later.

Two related behaviors apply after the upgrade:

  • Users must change their QuantumLock password before creating new QuantumLocks. A user whose QuantumLock password was created on 11.7 through 11.9 can still open existing QuantumLock-protected secrets, but cannot create a new QuantumLock or be assigned to one until they change their QuantumLock password. Until they do, those operations fail with a message stating that the key could not be decrypted with the user's current QuantumLock keys. Changing the QuantumLock password regenerates the user's key pair in the ML-KEM-1024 format.

  • Secrets modified on 12.0 or 12.1 before the fix cannot be recovered. If a user changed their QuantumLock password, or a QuantumLock was shared with another user, on 12.0 or 12.1 before upgrading to 12.2.000007, the secrets protected by that QuantumLock cannot be recovered automatically. They can be restored only from a database backup taken before the upgrade from 11.x.

See also the post-upgrade tasks in the Secret Server On-Prem Upgrade Checklist.

Note that users cannot remove their own QuantumLocks. When attempting to remove their QuantumLocks, users are presented with a 500 error, which means that this is not a supported operation.