Post-Quantum Cryptography: Are You Ready?

Find the Latest SoC Solutions
for... Automotive... IoT... Security... Audio... Video

Most experts suggest large-scale quantum computers will become a reality within the next decade and advise that being prepared is the best policy.

www.eetimes.eu/, Apr. 05, 2023 – 

The Quantum Computing Cybersecurity Preparedness Act was signed into U.S. law on Dec. 22, 2022, marking a crucial step in U.S. cybersecurity legislation that commenced in 2016. Back then, the U.S. National Institute of Standards and Technology (NIST) issued a call for proposals of post-quantum cryptographic algorithms that could resist attempts by quantum computers to compromise them. Now, eight years and four selection rounds later, NIST has announced its choice of quantum-resistant algorithms for public key encryption (CRYSTALS-KYBER) and digital signatures (CRYSTALS-DILITHIUM and SPHINCS+). The finalized standards will be published in 2024, but that doesn't mean the semiconductor industry and its customers should wait until then.

The threat that quantum computers pose to classical security methods like RSA and ECC has been growing steadily. It is widely recognized that once commercially available quantum computers have sufficient computation resources, current "hard problem" asymmetrical cryptographic techniques will not be adequate. There is no precise estimate of when large-scale quantum computers will become a reality. However, most experts suggest it is within the next decade and advise that whenever it might happen, being prepared is the best policy. National cybersecurity organizations across Europe are already publishing frameworks and checklists for companies and government agencies, with an emphasis on reviewing and equipping their security infrastructures ahead of time.

NIST algorithms become global standards

Although NIST is setting the U.S. policy on quantum-safe computing, its actions are of worldwide concern. Global adoption of cybersecurity standards is crucial for interoperability, with other regions of the world following the U.S., just as we have done for RSA and ECC. That's not to say Europe hasn't been involved in the submission process. Most submissions are from global teams, with European cryptographic experts well represented. But will European countries continue to adopt the NIST selections, or might there be country-specific differences?

"Everybody will follow this [NIST] standard, so it will be a worldwide standard," said Joppe Bos, senior principal cryptographer at NXP Semiconductors' Competence Center for Cryptography and Security in Belgium and a member of the NIST-selected CRYSTALS-KYBER algorithm team. "However, we already see in Europe that certain government agencies–for example, Germany's Federal Office for Information Security [BSI] and the National Cybersecurity Agency of France [ANSSI]–are saying they will support the selected schemes but might extend the list to standardized algorithms by certain other algorithms."

click here to read more...

 Back