Cybersecurity Policy Report, Federal Agencies Should Adopt Quantum-Proof Encryption by 2035, NIST Says, (Nov 12, 2024)
Federal agencies will be expected to adopt by 2035 encryption tools that can’t be broken by quantum computing technology, although some agency systems might have to move more quickly while others can take longer, the National Institute of Standards and Technology indicated today.
The transition from legacy encryption technology to post-quantum cryptography (PQC) will be complicated, but federal civilian executive branch agencies should start planning now, NIST said in a draft internal report that offers a rough timeline for the changeover.
NIST recently approved for immediate use three PQC standards. Following approval of the standards, NIST is required under a 2022 White House national security memorandum (NSM) to propose a timeline for civilian executive branch agencies to adopt the PQC standards and abandon most of their older encryption technologies. The transition for non-civilian systems is managed by the National Security Agency (CPR, Nov. 7).
Although quantum computers capable of quickly solving the math problems that underlie existing encryption tools don’t yet exist, the Biden administration has sought to speed development and deployment of PQC in systems used by the federal government and critical infrastructure.
“Even though the transition to post-quantum cryptography is starting before a cryptographically relevant quantum computer has been built, there is a pressing threat,” according to NIST.
“Encrypted data remains at risk because of the ‘harvest now, decrypt later’ threat in which adversaries collect encrypted data now with the goal of decrypting it once quantum technology matures,” it said.
“Since sensitive data often retains its value for many years, starting the transition to post-quantum cryptography now is critical to preventing these future breaches. This threat model is one of the main reasons why the transition to post-quantum cryptography is urgent,” it added.
The 2022 NSM “establishes the year 2035 as the primary target for completing the migration to PQC across Federal systems,” NIST noted.
“This date reflects the urgency of transitioning to cryptographic methods that can withstand future quantum threats. However, it is important to recognize that migration timelines may vary based on the specific use case or application,” it said.
“Some systems, particularly those with long-term confidentiality needs or more complex cryptographic infrastructures, may require earlier transitions, while others may adopt PQC at a slower pace due to legacy constraints or lower risk profiles,” NIST advised.
“Historically, the journey from algorithm standardization to full integration into information systems can take 10 to 20 years. This timeline reflects the complexity of companies building the algorithms into products and services, procuring those products and services, and integrating those products and services into technology infrastructures,” it said.
“While the transition to PQC is unprecedented in scale, it benefits from a level of awareness and understanding that previous cryptographic changes did not have,” NIST added. “NIST recognizes the complexity of migrating the vast array of systems that currently rely on [legacy] public-key cryptography and acknowledges that this transition will demand substantial effort across diverse applications and infrastructures with specific requirements and constraints.”
News: FederalLegislation DataSecurity