Quantum Attacks Targeting Nuclear Power Plants: Threat Analysis, Defense and Mitigation Strategies

Abstract: The advent of Cryptographically Relevant Quantum Computers (CRQCs) presents a fundamental and existential threat to the forensic integrity and operational safety of Industrial Control Systems (ICS) and Operational Technology (OT) in critical infrastructure. This paper introduces a novel, forensics-first framework for achieving quantum resilience in high-consequence environments, with a specific focus on nuclear power plants. We systematically analyze the quantum threat landscape across the Purdue architecture (L0-L5), detailing how Harvest-Now, Decrypt-Later (HNDL) campaigns, enabled by algorithms like Shor's, can retroactively compromise cryptographic foundations, undermine evidence admissibility, and facilitate sophisticated sabotage. Through two detailed case studies, \textsc{Quantum~Scar} and \textsc{Quantum~Dawn}, we demonstrate multi-phase attack methodologies where state-level adversaries exploit cryptographic monoculture and extended OT lifecycles to degrade safety systems while creating unsolvable forensic paradoxes. Our probabilistic risk modeling reveals alarming success probabilities (up to 78\% for targeted facilities under current defenses), underscoring the criticality of immediate action. In response, we propose and validate a phased, defense-in-depth migration path to Post-Quantum Cryptography (PQC), integrating hybrid key exchange, cryptographic diversity, secure time synchronization, and side-channel resistant implementations aligned with ISA/IEC 62443 and NIST standards. The paper concludes that without urgent adoption of quantum-resilient controls, the integrity of both physical safety systems and digital forensic evidence remains at severe and irreversible risk.

• The paper develops a forensics-first threat framework showing how harvest-now-decrypt-later campaigns, forged certificates, and timing manipulation could compromise nuclear OT and obscure sabotage.
• The paper models Quantum Scar and Quantum Dawn attack paths, estimating success rates of 35–68% and 8–34% at baseline, below 1% with full post-quantum cryptography, while noting the probabilities are expert-based rather than empirically validated.
• The paper recommends hybrid ML-KEM-768 key exchange, ML-DSA firmware signing, authenticated time synchronization, cryptographic diversity, side-channel testing, and fail-closed migration controls, with early defenses providing 8–12 times greater modeled risk reduction than downstream measures.

Overview and motivation

This paper, by Baseri and Waller (2602.21524), develops a threat analysis and defense framework for quantum-enabled attacks on nuclear power plant OT/ICS environments. Its central premise is a temporal asymmetry: nuclear assets operate under 60–80 year license horizons while CRQCs capable of breaking RSA-2048 and ECC are projected within 10–15 years, so cryptographic decisions made today govern safety-critical systems well past CRQC arrival. The paper's distinctive contribution is a "forensics-first" framing: it treats forensic integrity—event reconstruction, log attestation, attribution—as operationally essential to nuclear safety rather than merely evidentiary, arguing that HNDL campaigns plus post-CRQC forgery can produce forensic states in which investigators cannot distinguish sabotage from equipment failure. The authors state plainly that the framework assumes state-level adversaries with future CRQC access (≥4,098 logical qubits), complete Shor breaks of RSA-2048/ECC-256/384, and Grover-limited symmetric primitives; this is an assumption about adversary capability rather than an established fact.

The paper also asserts architectural monoculture: over 85% of facilities reportedly share PKI across safety-instrumented and control domains, so a single CA compromise cascades across safety boundaries. This figure is presented without a documented survey basis and should be read as an estimate; it is nonetheless load-bearing for the risk numbers discussed below.

Cryptographic foundations and PQC deployment constraints

The paper maps classical primitives onto quantum threats: all asymmetric algorithms (RSA, FFDHE, ECC) drop to zero quantum security under Shor; AES loses half its effective key strength under Grover (AES-256 retains 128 bits); hash functions lose collision resistance from $n/2$ to roughly $n/3$ bits and preimage resistance from $n$ to $n/2$ under Brassard-style algorithms. The implication is that migration must replace asymmetric primitives wholesale while strengthening symmetric/hash choices to AES-256 and SHA-384/512.

For replacements, the paper evaluates NIST-standardized PQC (ML-KEM per FIPS 203, ML-DSA per FIPS 204, SLH-DSA per FIPS 205, plus Falcon and HQC as pending alternatives) along two axes that matter in OT: side-channel attack surface and performance overhead relative to classical baselines. The headline overhead figures are stark:

Algorithm	Role	Overhead vs. classical	Deployment verdict
ML-KEM-768	KEM	34.4×	Suitable for L2/L3
ML-DSA-65	Signature	59.2×	Viable for firmware signing
Falcon-512	Signature	27.2×	Compact but SPA-broken unhardened
SLH-DSA-128s	Signature	122.8×	Archival only
HQC-192	KEM	411.0×	Limited deployment

These figures are measured on server-class x86 via liboqs; the paper notes PLC/RTU-class MCUs are typically 10–100× slower, so absolute timings should not be transferred directly to embedded targets. The side-channel assessment identifies unresolved implementation risks even after migration: ML-KEM-768 remains vulnerable to APA and template attacks, Falcon-512 admits complete key recovery via SPA, and HQC-192 has multiple unmitigated vectors. The paper is explicit that PQC addresses quantum cryptanalysis but not conventional side channels—a point often elided in migration planning—and therefore mandates constant-time implementations, NTT masking, fault checks, and leakage assessment as part of any nuclear deployment.

Attack scenarios

Two case studies operationalize the threat model. Both assume air-gapped safety systems are reachable over time through supply-chain compromise, abuse of maintenance workflows, or dormant pre-positioned implants—not insider collusion—and both culminate in simultaneous physical compromise and forensic corruption.

Quantum Scar exploits PKI/firmware monoculture. A three-phase chain—HNDL collection of ~4.2 TB of encrypted traffic over 18 months, post-CRQC factorization of vendor and plant root CA keys, then execution with forensic obfuscation—deploys maliciously signed SIS firmware (disabling RCIC when core temperature exceeds a threshold), injects a false turbine trip, and manipulates PTP timing by +15.3 ms so sequence-of-events correlation fails. All forged artifacts carry cryptographically valid signatures, producing an asymmetric forensics condition: the adversary decrypts harvested traffic with a CRQC while investigators cannot.

Quantum Dawn is access- and human-factor centric: spear-phishing plus a zero-day establishes a dormant implant, ~3.8 TB of VPN/firmware traffic is harvested over 20 months, and post-CRQC factorization forges activation triggers. Sabotage spoofs core pressure readings, blocks SCRAM during a transient, and shifts PTP timing by −12.4 ms while leaving quantum-signed false logs implicating vendor error.

Both scenarios are mapped systematically to STRIDE categories, Purdue levels L0–L5, and MITRE ATT&CK for ICS techniques. Because existing ATT&CK cannot represent quantum-specific behaviors, the paper proposes six technique extensions (T1001–T1006): quantum cryptanalysis, HNDL collection, quantum-forged evidence, temporal synchronization attacks, quantum-authenticated persistence, and quantum certificate forgery. This taxonomy is a reusable contribution independent of the specific scenarios.

Probabilistic risk results

Success probability is modeled as a conditional product across phases, $$\mathbb{P} = \mathbb{P}(S_1)\times\mathbb{P}(S_2|S_1)\times\mathbb{P}(S_3|S_1 \cap S_2)$$. The resulting figures are the paper's strongest quantitative claims:

Scenario / posture	Baseline success	Targeted facility	Multiple attempts	SL-4 compliant	Full PQC
Quantum Scar	35–68%	51–78%	88–99%	2–8%	<1%
Quantum Dawn	8–34%	17–50%	41–88%	1–5%	<1%

Sensitivity analysis yields $$\partial\mathbb{P}/\partial S_1 > \partial\mathbb{P}/\partial S_2 > \partial\mathbb{P}/\partial S_3$$ for both scenarios: early-phase controls (HNDL disruption, PKI isolation, cryptographic diversity) deliver 8–12× greater risk reduction than downstream defenses. ISA/IEC 62443 SR 1.1 cryptographic diversity alone drives Quantum Scar feasibility below 1%. These probability ranges rest on interval estimates for each phase that the authors assert rather than derive from empirical data—the phase probabilities encode expert judgment about HNDL campaign prevalence, CRQC readiness, and execution conditions—so they function as structured risk arguments, not validated measurements. Their value lies in the comparative ranking of mitigations, which is robust to reasonable variation in the inputs.

A further strong claim deserves note: the paper states over 80% of nuclear-critical infrastructure remains below ISA/IEC 62443 SL-3, and that no production systems currently monitor for quantum-stage indicators. If accurate, the "detection vacuum" means HNDL campaigns would be invisible until decryption capability exists—at which point remediation cannot undo exfiltration.

Defensive validation framework

The defense section translates attack methodology into seven measurable acceptance criteria (V1–V7) under an assumed-breach model: TLS 1.3 hybrid KEM conformity at L3.5 conduits (conformance ≥0.995, downgrade attempts ≤10⁻⁴), MTU/fragmentation compliance (single-fragment on control paths, excluding HQC-256 from constrained links), latency budgets ($t_{hs,95\%}$ ≤ 50 ms server-class, zero on-the-fly handshakes in L0–L2 loops), code-signing compliance (≥99% ML-DSA-65, SLH-DSA archival only, chain length ≤2), forensic hashing and time integrity (≥99.9% SHA-384/512 and authenticated time, SOE skew ≤100 ms), TVLA first-order leakage thresholds ($|t|<4.5$), and negative testing enforcing fail-closed behavior with no silent fallback.

The design choices directly counterattack the case studies: hybrid X25519+ML-KEM-768 key exchange with classical-only handshakes failing closed defeats PKI monoculture exploitation; ML-DSA firmware signing with monotonic anti-rollback counters defeats signature forgery and rollback; NTS-secured NTP and IEEE 1588-2019 authenticated PTP defeat the temporal manipulation central to both scenarios' forensic paradoxes. The paper also specifies residual risk management for mixed-trust legacy enclaves, ongoing HNDL exposure beyond the CRQC horizon, performance degradation contingencies, and session resumption hygiene—an acknowledgment that full SL-4 + PQC does not reduce risk to zero.

Limitations and open questions

Several limitations bear directly on the results. The probabilistic model depends on point assumptions about CRQC arrival (2030–2040) and logical qubit requirements (4,098 for RSA-2048) drawn from vendor roadmaps and error-correction literature; material changes in either direction shift the urgency calculus substantially. The monoculture statistic (85%) and the sub-SL-3 statistic (80%) lack cited empirical provenance within the paper. The attack scenarios, while grounded in historically observed ICS tradecraft (TRITON-style SIS manipulation), are constructed exercises; no component of the quantum phases has been demonstrated empirically. Finally, the validation criteria are specified but not reported as executed against a live or simulated plant—the paper defines the tests and acceptance thresholds rather than presenting test-run results. Open questions include how IEC 61508 safety certification cycles can accommodate cryptographic updates without invalidating certifications, and what detection signals could identify HNDL collection before CRQC availability.

Conclusion

The paper provides an integrated, quantified treatment of quantum-era risk to nuclear OT, combining level-specific vulnerability analysis, two fully specified multi-phase attack scenarios mapped to standard adversarial taxonomies, six proposed MITRE ATT&CK extensions, and a defense-in-depth migration framework with measurable acceptance criteria. Its principal quantitative findings—that baseline attack success reaches 51–78% against targeted facilities, falls to 1–8% under comprehensive SL-4, and below 1% under full PQC migration, with Phase 1 controls offering 8–12× the leverage of later-phase defenses—are best understood as a defensible prioritization argument built on asserted phase probabilities rather than measured ones. Within that framing, the actionable conclusion is concrete: cryptographic diversity across safety domains, hybrid key exchange, authenticated time synchronization, and side-channel-hardened PQC deployments constitute the highest-leverage near-term controls, and their value derives primarily from disrupting the harvestable attack surface that makes retroactive quantum compromise irreversible.