Post‑Quantum Cryptography (PQC) support roadmap for Harman AIR SDK?

[worakitbp]

Hi Harman AIR SDK team,

We are currently reviewing the long‑term security roadmap for our desktop applications built on the Harman AIR SDK, especially with respect to Post‑Quantum Cryptography (PQC) and cryptographic longevity.
We would like to understand if there are any plans, ongoing discussions, or future considerations regarding PQC support in the AIR SDK, for example:

Potential support for post‑quantum cryptographic algorithms (e.g. PQC signatures or key establishment) within the AIR runtime or SDK.
Planned changes or upgrades to the underlying cryptographic or TLS stack that may improve post‑quantum readiness.
Any recommended architectural guidance for AIR-based applications that need to align with post‑quantum security requirements.

We understand that PQC adoption across platforms is still evolving, and that browser-like runtimes may have constraints. Our goal here is simply to understand Harman’s strategic direction or outlook, whether short‑term, medium‑term, or exploratory.
Any insight the team can share would be greatly appreciated.
Thank you for maintaining and supporting the AIR ecosystem.

[ajwfrost]

Hi

There are two separate issues here that we can see:

1. PQC support for network communications. For example when using HTTPS or secure socket communications.
   These primarily use the underlying operating system capabilities which means that the security is somewhat out of our hands. There are some combinations of scenarios and operating systems that would mean we use internal security via OpenSSL, so the main approach for this would again to ensure we keep up to date with OpenSSL capabilities/versions so that this can take advantage of newer capabilities.
   For all of these, we only act as the client i.e. security negotiations with the server is going to inform what mechanisms are actually used, and there are no ActionScript APIs that would determine what should be or is being used.

2. Encryption capabilities within AIR itself - using classes from the air.security package.
   For these, we would develop them further as required, although the (AES) symmetric encryption mechanisms used are supposed to be pretty resistant already against quantum attacks if you use a 256-bit key. But we are always open to suggestions for additional capabilities such as this (or they could be provided by third parties via ANEs or Crossbridge-built libraries).

Let me know if that helps or if you have other questions!

thanks

Andrew

[worakitbp]

Thanks a lot for the clear explanation and ongoing support. I really appreciate the effort. I’m particularly interested in item 2 and would be glad if the team could consider it in the future.