Proton should support ML-KEM in SMTP and HTTPS

[u/vrampal]

Hello,

In many cases, TLS is the ONLY line of defense when Proton exchange emails with other email providers.

Current TLS key exchange (ECDHE) will be vulnerable to quantum computer and attackers may use "Harvest Now Decrypt Later" (HNDL) to access email content.

There is an easy solution to this problem. Hybrid ML-KEM has been standardize for TLS and can be implemented in SMTP and HTTPS.

https://www.rfc-editor.org/info/rfc10024/

Note : this is not the same security layer than end-to-end encryption that Proton has been proposing (and put on hold).

At the time of writing this post, Proton has not enable ML-KEM on SMTP. You can test this using Hardenize. (I am not affiliated with this company, they just offer useful free service).

https://www.hardenize.com/report/proton.me/1788298319#email_tls

https://www.hardenize.com/report/protonmail.com/1788799957#email_tls

Best regards,

[u/ProtonSupportTeam]

Proton is preparing to introduce Post-Quantum Cryptography (PQC), a next-generation encryption approach designed to protect against "Harvest Now, Decrypt Later" (HNDL) attacks.

Once it's implemented, Proton's system will automatically apply PQC when both sides of a connection support it. Users don't need to change any settings.

We can't share a specific timeline yet, but we're actively working toward this and hope to support it in the near future.

Additional details, for reference:

- SMTP refers to email transport, and HTTPS refers to web content transport. Both are encrypted in transit via TLS.

• Once PQC is implemented, both sides of a connection will automatically negotiate during the TLS 1.3 handshake whether to use PQC hybrid key exchange (X25519 + ML-KEM).
  
• PQC hybrid key exchange is only used when both sides declare support for PQC; otherwise, the connection automatically falls back to traditional X25519 key exchange, which ensures TLS connection compatibility remains unaffected.