By Samantha Mabey, Director, Product Marketing Management Director, Certificate Solutions, Entrust
The starting whistle has gone off in the race for quantum-safe cryptography solutions. Last week, the National Institute of Standards and Technology (NIST) released their draft standards for post-quantum cryptography (PQC).
As my colleague Greg Wetmore noted in July, all eyes have been on the NIST PQ competition for the last several years, with the third-round finalist algorithms announced last summer, and now the release of the PQC draft standards – a major milestone in quantum readiness and the future migration to quantum-safe cryptography.
Despite knowing the high stakes – by most analysis, advancements in quantum computers will result in them being capable of breaking traditional public key cryptography within the decade – some organizations have been hesitant to begin their PQC preparations until NIST’s draft standards were released. That barrier has been crossed.
Now, draft standards for three algorithms are open for public comment and feedback until November 22, 2023; with the standards likely to be finalized in 2024. Once this happens, organizations will be expected to make the transition to these algorithms designed to withstand quantum computer attacks in order to protect their sensitive data. And with the fourth round of the competition still underway, it’s no surprise that the NIST release also states that “While these three will constitute the first group of post-quantum encryption standards NIST creates, they will not be the last.” So, more to come.
The draft standards weren’t the only quantum-related announcement last week. NIST, Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) released a joint factsheet titled Quantum-Readiness: Migration to Post-Quantum Cryptography. The intention of the joint factsheet is to further encourage – both government agencies and organizations – to begin their planning for the migration to PQC now. Why?
The migration will take time. The factsheet notes that “creating quantum-readiness roadmaps, conducting inventories, applying risk assessments and analysis, and engaging vendors” will take time – likely several years. Not only that, but the migration to PQC will be more complex than anything we’ve ever done before and will touch almost every piece of infrastructure.
Harvest now, decrypt later attacks. There is a known threat to long-life data (any sensitive data that needs to remain confidential for 10+ years) where bad actors are harvesting it today, with the intent of decrypting it once a quantum computer is capable. This same threat also exists for long-life connected devices.
Regardless of the nature of your organization, steps need to be taken to protect your data from the quantum threat. From inventorying cryptographic systems and assets, to creating a migration plan, to speaking with your technology vendors about their own PQ roadmap – there is much to be done and there’s no time to waste in getting started.