Explainers

Encrypted traffic,

Post-quantum encryption leaves a fingerprint

The key gets bigger, and the traffic shows it

Today's key share X25519 32 bytes
Post-quantum hybrid X25519 + ML-KEM-768 1,216 bytes

What PQClass tells from the encrypted traffic

  • 86%Is post-quantum cryptography in use?
  • 91%Which browser made the connection?
  • 98%Which operating system?
The key a browser sends to start a post-quantum connection is about 38 times larger than today's. Nothing is decrypted: PQClass works on the encrypted traffic as it is. Accuracies are from our ICC 2025 paper on real-world traffic.

A large enough quantum computer would break the key exchange that protects most connections today, so browsers and servers have begun moving to post-quantum cryptography (PQC), using algorithms recently standardised by NIST. The switch is happening quietly, connection by connection, and network operators cannot see it: the traffic is encrypted.

The new keys are much bigger than the old ones, and that leaves a mark on the shape of a connection even when every byte is encrypted. Our PQClass pipeline reads that shape. On real-world traffic it detects whether a post-quantum algorithm is in use with 86% accuracy, and from the same post-quantum traffic it identifies the browser (91%) and the operating system (98%).

That matters on both sides. Network engineers can plan for the extra load and latency the new algorithms bring, and security teams can see how far the migration has actually gone on their network. This work continues in our Israel–Cyprus project on multi-layered classification of post-quantum encrypted traffic, with Angelos Marnerides.