NIST Releases Its Initial Set of Finalized Post-Quantum Encryption Standards

The National Institute of Standards and Technology (NIST) has formally announced three new post-quantum cryptography (PQC) standards  ML—KEM, ML-DSA, and SLH-DSA, on August 13, 2024, to strengthen cryptographic defenses against potential cyberattacks by quantum computers.

With this significant accomplishment, cryptography enters a new age and establishes a solid basis for data security in the post-quantum era.

Also Read: First Standardised Post-Quantum Cryptography (PQC) Algorithms Timeline for 2024 by NIST

Undoubtedly, if large-scale quantum computers become a reality in the future, this news signifies a critical turning point for guaranteeing the security of modern communications.

The article briefly discusses the most recent NIST announcement, the expected development of the system with these new standards, and the following moves.

What Makes Quantum Computers Potentially Hazardous?

Modern technology relies on cryptography, which secures everything from banking transactions to online conversations.

Many cryptographic techniques currently in common usage are based on mathematical puzzles that are computationally impossible for conventional (non-quantum) computers to solve, such as factoring huge integers.

If quantum computers had not been developed, they could have continued using traditional cryptography for many years. These devices employ quantum physics properties to do specialized computations far more quickly than conventional computers.

Unfortunately, the solutions to the mathematical puzzles that underlie the majority of encryption in use today are part of those specialized computations.

Laurie E. Locascio, director of the Department of Commerce’s NIST and undersecretary of commerce for standards and technology, said in an announcement that “quantum computing Technology could become a force for solving many of society’s most intractable problems, and the new standards represent NIST’s commitment to ensuring it will not simultaneously disrupt our security.” 

~ These finalized standards are the capstone of NIST’s efforts to safeguard our confidential electronic information.

However, because quantum computers can compute things that conventional computers cannot, they can threaten cybersecurity. They could crack public encryption systems, which could have disastrous effects on companies, governments, and online communication.

For instance, Quantum computers might break code, factor big numbers, and decipher the algorithms underlying encryption keys. Even with encryption, users might only trust the information they send or receive over the internet if encryption techniques are maintained.

Adversaries could produce false certificates, throwing doubt on the legitimacy of any online digital identity.

Although no large-scale, stable quantum computers can now crack modern encryption, scientists believe there will soon be a cryptographically relevant quantum computer (CRQC).

For example, a survey conducted in 2023 found that over 25% of experts surveyed anticipated the appearance of a CRQC within the next ten years.

The Algorithms for Future Competence

When NIST launched its first Post-Quantum Cryptography Standardisation Project in 2016, the road to PQC officially got underway. NIST called cryptographers and security specialists worldwide to design and submit their candidates for PQC as part of the project, and they additionally announced a competition.

Developing post-quantum algorithms resistant to attacks by both conventional and quantum computers became the objective. These algorithms needed to be reliable, trustworthy, and tested.

Since then, governments, organizations, and academics worldwide have worked together to create and submit their PQC candidates for assessment and peer review.

NIST revealed the first four PQC algorithms in a preliminary announcement released in July 2022 following the completion of the third phase of standardization:

• CRYSTALS-Kyber for KEM (Key Establishment Mechanism) for general encryption.
• CRYSTALS-Dilithium, SPHINCS+, and Falcon, for digital signatures

RYSTALS-KYBER and CRYSTALS-Dilithium were chosen for their robust security and superior all-around performance.

FALCON was selected for use scenarios where the CRYSTALS-Dilithium signatures are too large. To avoid depending solely on lattice security for signatures, SPHINCS+ was selected.

Following the third standardization stage, NIST assessed four candidates—Classic McEliece, BIKE, HQC, and SIKE—for Key Establishment Mechanism in the fourth round of standards.

In the meantime, three draft PQC standards were also produced by NIST in 2023 to solicit input from the industry and make the necessary adjustments to guarantee successful implementation.

Fips 203 Outlines the ML-KEM Standard based on the CRYSTALS-KYBER proposal.

FIPS 204 Describes the ML-DSA Standard developed from the submission of CRYSTALS-Dilithium.

FIPS 205  Deriving from the SPHINCS+ submittal, FIPS 205 specifies the SLH-DSA Standard.

NIST has officially recognized the draft standards as the first official PQC standards following the completion of the fourth and final cycle of standardization, which lasted for two years.

Emphasises Security

Apart from the standards, further efforts are being made to prepare the U.S. government for post-quantum cryptography.

For instance, the National Security Agency published its Commercial National Security Algorithm Suite 2.0 in 2022, outlining specifications for algorithms in national security systems that will be quantum-resistant.

In the same year, agencies were instructed by the Office of Management and Budget to inventory the cryptography present in specific systems and determine the amount of funding required to transition to post-quantum standards.

The White House estimated that $7.1 billion in funding will be required to achieve the transition from 2025 to 2035 based on the assumptions above.

This estimate was included in a report last month, mandated by Congress, that described the federal government’s strategy to transition to post-quantum cryptography, or PQC, standards.

By regulations, agency migration plan recommendations must be released by OMB a year following the original publication of NIST standards.

The government determined that it would be “wise” to inventory cryptography in a more automated manner, according to Anne Neuberger, deputy national security advisor for cyber and new technology, who made this announcement at the White House. Neuberger also emphasized the significance of setting priorities.

“We are discovering how crucial it is to determine which systems are the most sensitive while conducting such inventories. Which data has the most value?

Indeed, what information would concern you if an attacker using a quantum computer might decrypt it in nine or ten years?” Said Neuberger.  “We have lots of that in the intelligence community. We have lots of that in our Department of Defense.”

The “steal now, decrypt later” strategy jeopardizes data that has been encrypted today.

Researchers in security issues warn that companies would only catch up if they take too long to transition to post-quantum encryption standards. There is a recent surge in “steal now, decrypt later” thefts, especially by the most sophisticated nation-state APT hacking groups.

These groups target encrypted information that is nearly impossible to crack but will be easy to decode once quantum computers are accessible. Sensitive personal information that is unchangeable and “permanent” data that might still cause havoc in ten or more years are the most vulnerable.

Though the significantly increased power of these computers promises enormous leaps in various areas, from health care to general technology, the news surrounding quantum computing is not all “doom and gloom.” Additionally, these machines will push A.I. to an ability that existing systems only offer temporary glimpses of.

However, they will also make the arithmetic problems (factoring large numbers into prime factors) that support modern encryption easy to solve. This will break protocols like the Secure Sockets Layer (SSL) and AES 256-bit, which are essential to the safe operation of the internet and make individual files vulnerable.

Now that the necessary technologies are readily available, organizations should start working on their switching strategy.

Karl Holmqvist, the CEO and founder of Lastwall, states: “We need to switch PQC algorithms since there are ongoing nation-state attempts taking currently encrypted data, as the chiefs of the FBI, NSA, and even the White House have informed us. This is a significant step forward for defense against a major threat, and NIST’s announcement is excellent. In the last few years, the landscape of quantum computation has dramatically changed.”

Recommended Moves

The path ahead is evident with the release of the NIST’s Post-Quantum Cryptography (PQC) standards. Making a step switching to PQC is tremendously huge.

There are multiple stages involved, including:

• Creating a Cryptographic Bill of Materials or a thorough and updated cryptographic resource to assess the impact of PQC on existing cryptographic systems.
• Setting precious data and systems as migration priorities determines which systems cannot run PQC algorithms.
• Replacing or updating outdated systems that cannot process PQC techniques.
• Choosing proper algorithms for post-quantum computing.
• Placement and constant monitoring of selected algorithms.

Final Thoughts

The NIST recently released PQC standards are the initial steps towards enhancing encryption algorithms as we get closer to the eventual development of quantum computers.

Even though no encryption is impenetrable and many techniques may eventually be found, the three algorithms that NIST has selected could be adequately secure for the near future and satisfy the pressing needs of several businesses and organizations.

Talk to our Cyber Security Experts To Stay Updated and Get Ready for the Next Move and Upgrade!