Can MACsec Be Made Quantum-Resistant?

Yes—with the correct data cipher, key management, and authentication protocols.

Known quantum algorithms do not currently present a practical threat to GCM-AES-256 or GCM-AES-XPN-256. For higher-speed circuits, XPN’s extended packet numbering reduces the need for frequent SAK rekeying caused by packet-number exhaustion.

A generic quantum brute-force attack against AES—a symmetric encryption method—would be attempted using Grover’s algorithm. However, Grover’s algorithm provides only a quadratic advantage over classical brute force. Attacking AES-256 would therefore require on the order of 2¹²⁸ Grover iterations, each involving many sequential quantum operations, subject to substantial error-correction and implementation constraints.

Even at theoretically absurd iteration rates—such as one iteration per picosecond—this remains infeasible in practice. Think of an attack taking hundreds of millions of times the age of the universe to complete.

Although known quantum algorithms do not pose a practical threat to an AES-256 cipher, the deployment as a whole is resistant to harvest-now-decrypt-later attacks only if the CAK or MSK is provisioned without depending on quantum-vulnerable public-key cryptography.

This can be accomplished through either:

• A securely provisioned 256-bit symmetric CAK.
• An appropriately implemented and supported hybrid/post-quantum key-establishment and authentication path.

MACsec itself is not inherently quantum-ready merely because it encrypts frames with a 256-bit AES cipher. The determining factor is the complete MACsec key hierarchy:

• Use GCM-AES-256 or GCM-AES-XPN-256 for data-plane protection.
• Use the strongest mutually supported MKA integrity and key-derivation suite—preferably the 256-bit option where supported.
• For static CAK/PSK provisioning, generate the key using 256 bits of true entropy.

Verify the MKA integrity and key-derivation configuration independently of the MACsec payload cipher. Selecting a 256-bit data-plane cipher does not, by itself, establish that the complete key hierarchy meets this design.

The important part is to ensure that CAK/MSK provisioning and any certificate-based authentication used to obtain the CAK or MSK do not depend solely on quantum-vulnerable public-key cryptography.

Commonly used public-key technologies—including RSA, Diffie–Hellman, and elliptic-curve cryptography—are vulnerable to quantum attacks via Shor’s algorithm and, as such, must be replaced.

Quantum-resistant migration must therefore replace both classical key establishment and public-key authentication:

• ML-KEM (FIPS 203) is the NIST-standardized KEM for establishing symmetric session keys.
• Post-quantum signature schemes such as ML-DSA (FIPS 204) are needed to replace RSA/ECC signatures.

A good overview of Shor’s and Grover’s algorithms by Fortinet can be found here:

Shor’s and Grover’s Algorithms — Fortinet

For WAN/DCI connections over Equinix Fabric Virtual Connections, using either native MACsec, or WAN MACsec, the following elements provide the clearest, currently deployable quantum-resistant model for links between known, controlled endpoints:

1. A randomly generated 256-bit CAK—not a human-selected passphrase.
2. The strongest mutually supported MKA integrity and key-derivation suite, preferably the 256-bit AES-CMAC/MKA option where supported.
3. GCM-AES-XPN-256 for MACsec payload encryption.
4. Defined CAK rotation and SAK rekey procedures.

5. Protected operational handling of CAKs:

   • HSM/KMS where possible.
   • Strict access control.
   • Audited injection.
   • A secure backup/escrow policy.
   • Zero exposure in configurations or logs.

In this model, there is no reliance on RSA, DH, ECDH, or certificates to establish the CAK. Consequently, a future cryptographically relevant quantum computer would have no classical public-key exchange to break retrospectively—provided, of course, the CAK was generated with genuine 256-bit entropy, securely distributed, and kept secret.

For carrier Ethernet, DCI, cloud-on-ramp handoffs, and controlled router-to-router or switch-to-switch links, this is often the most immediately defensible “quantum-resistant MACsec” approach.