tech · quantum risk

Is NAC 802.1X Quantum Proof? Network Security & PQC

Risk: high · Confidence: high · Reviewed: 2026-07-19

Verdict

NAC and 802.1X are not quantum-proof when EAP-TLS and RADIUS infrastructure use classical certificates. Wired/wireless admission PKI is part of the same migration as Wi‑Fi and RADIUS pages.

Overview

NAC systems decide whether a device may join a LAN based on identity and posture. 802.1X with EAP-TLS is a common strong pattern—and a large certificate deployment.

Quantum risk follows the EAP and RADIUS crypto. Password-based EAP methods have different classical weaknesses; they are not a PQC strategy.

Deep-link radius-eap and wifi pages for enterprise wireless specifics.

Cryptographic profile

Signatures: EAP methods (EAP-TLS etc.), RADIUS shared secrets and certs, Supplicant and switch identities
Hash: Depends on EAP method
Public-key exposure: Campus and datacenter admission often rests on classical EAP-TLS and RADIUS PKI.

What breaks

Enterprise CA for 802.1X never inventoried
RADIUS servers with decade-old TLS configs
Assuming NAC segmentation replaces encryption upgrades

Mitigations

Inventory EAP methods and cert profiles
Short-lived machine certs where operable
Align with radius-eap and certificate lifecycle

FAQ

Is MAC auth bypass quantum-relevant?

That is classical access control weakness; fix it separately from PQC.

Same CA as Wi‑Fi?

Often yes—one PKI program should cover both.

Key concepts (technical dictionary)

Terms used on this page — open a definition:

Full technical dictionary →