April 28, 2024 at 12:03PM
Google Chrome 124 introduces quantum-resistant encryption, causing connection issues for some users and impacting servers and firewalls. This hybrid post-quantum TLS key exchange aims to protect against future attacks but can lead to connection drops for web applications and servers. Users can mitigate the issue by disabling the new feature in Chrome settings or the enterprise policy.
Based on the meeting notes, it appears that the release of Chrome 124 with the new quantum-resistant X25519Kyber768 encapsulation mechanism has caused connectivity issues for some users. This is due to the implementation of post-quantum secure TLS key encapsulation mechanism utilizing the Kyber768 quantum-resistant key agreement algorithm for TLS 1.3 and QUIC connections.
The connectivity issues affect web applications, firewalls, and servers, resulting in dropped connections after the ClientHello TLS handshake. These errors are not caused by a bug in Google Chrome but rather by web servers failing to properly implement Transport Layer Security (TLS) and not being able to handle larger ClientHello messages for post-quantum cryptography.
To address the connectivity issues, affected Google Chrome users can mitigate the problem by disabling the TLS 1.3 hybridized Kyber support in Chrome under the chrome://flags/#enable-tls13-kyber flag.
Administrators can also disable the PostQuantumKeyAgreementEnabled enterprise policy under Software > Policies > Google > Chrome, or contact vendors to get an update for servers or middleboxes on their networks that aren’t post-quantum-ready.
It’s important to note that long-term, post-quantum secure ciphers will be required in TLS, and the Chrome enterprise policy allowing disabling it will be removed in the future.
Furthermore, a website named tldr.fail provides additional information on how large post-quantum ClientHello messages can break connections in buggy web servers and offers details for developers on how to fix the bug.
Microsoft has also released information on how to control this feature via the Edge group policies.
Lastly, it’s important to acknowledge that this policy is a temporary measure and will be removed in future versions of Google Chrome. It may be enabled to allow testing for issues and may be disabled while issues are being resolved.