Your RSA-Encrypted Archives Are Already Exposed

An organization adopting post-quantum cryptography usually starts with its new exchanges. That makes sense, and it is not enough. The backups, archives and documents exchanged over the last ten years are encrypted with RSA or elliptic curves, and they are exactly what harvest now, decrypt later is after.

A copy of those archives taken yesterday, at a provider, on a backup tape or in a mailbox, becomes readable the day a quantum computer can break RSA. The only way to protect it is to re-encrypt the original while there is still time.

Re-encrypting without decrypting to disk

The fpqc reencrypt command of Feranor PQC Suite moves those archives to post-quantum cryptography, file by file. It opens each message with the old key, encrypts it again for your post-quantum recipients, and never writes any plaintext.

fpqc reencrypt archive/*.p7m --key old-rsa.pem --key old-ec.p12 --key-passphrase-file key.pass -r bob.pem -d migrated

• Inputs. The classical CMS messages written by OpenSSL (cms -encrypt), S/MIME clients and .NET's EnvelopedCms, encrypted with RSA (PKCS #1 v1.5 or OAEP) or ECDH, with AES or Triple DES content.
• Keys. Your old private keys, in PEM or PKCS #12, with their certificate when there is one. The first key that opens a message is used.
• Outputs. One .pqc.p7m file per input, encrypted under the ANSSI profile with hybrid ML-KEM and ECDH. A message that was signed then encrypted keeps its signature inside.
• Journal. One JSON line per file, with the status, the algorithms found and the SHA-256 of the input and the output.

Batches you can safely run again

An archive migration counts thousands of files, and it will be interrupted at some point. That is what the journal is for. Run again with the same journal, the command skips what is already done, recognizing it by its hashes, and resumes where it stopped. An unexpected output in the directory, left by someone else or by another batch, makes the input fail instead of being overwritten.

Each output appears only once it is complete on disk. A failure on one file does not stop the batch, and the exit code tells your script whether everything went through, whether some messages found no key, or whether something else failed.

What is stored today under RSA is readable tomorrow by anyone who keeps a copy. Re-encryption is the only way to take back control.

Where to start

• Inventory. Where your encrypted archives are, under which keys, and how long they must stay confidential.
• Try. A batch of a few files, then fpqc inspect on the outputs to see recipients and algorithms, with no key at all.
• Migrate. The archives you hold, batch by batch, keeping the journals as a record of what was done.
• Decide. When the old classical copies and the old keys no longer have a reason to exist, according to your own retention rules.

One precaution, finally. A classical message has no integrity of its own. Re-encryption is meant for the archives you hold, not for processing messages sent by third parties in production.