Cybersecurity Policy Report, NIST Unveils Quantum-Proof Encryption Tools, Urges Immediate Adoption, (Aug 13, 2024)
Organizations Mentioned:Information Technology Industry Council (ITI)
Three encryption tools designed to resist attacks by quantum computers were issued today by the National Institute of Standards and Technology, and NIST and the White House encouraged organizations to begin deploying the tools immediately.
“Researchers around the world are racing to build quantum computers that would operate in radically different ways from ordinary computers and could break the current encryption that provides security and privacy for just about everything we do online,” NIST said in a news release.
“The algorithms announced today are specified in the first completed standards from NIST’s post-quantum cryptography (PQC) standardization project, and are ready for immediate use,” it added.
A Federal Register notice due to be published tomorrow will officially add the quantum-resistant encryption tools to the Federal Information Processing Standards (FIPS).
“Over the past several years, there has been steady progress toward building quantum computers. The security of many commonly used public-key cryptosystems would be at risk if large-scale quantum computers were ever realized. In particular, this would include key-establishment schemes and digital signatures that are based on integer factorization and discrete logarithms (both over finite fields and elliptic curves),” according to the notice.
NIST has been evaluating quantum-resistant encryption since 2016, and the standards released today are the result of three rounds of testing that winnowed 82 proposed standards down to three. NIST said the work would continue and that additional standards would eventually be released.
White House directives issued in 2022 required executive branch agencies to begin inventorying their information technology systems to identify those that would be most vulnerable to quantum computing technologies and prepare for the advent of quantum-resistant encryption (CPR, Nov. 18, 2022).
“Encryption carries a heavy load in modern digitized society. It protects countless electronic secrets, such as the contents of email messages, medical records and photo libraries, as well as information vital to national security. Encrypted data can be sent across public computer networks because it is unreadable to all but its sender and intended recipient,” NIST explained.
“Encryption tools rely on complex math problems that conventional computers find difficult or impossible to solve. A sufficiently capable quantum computer, though, would be able to sift through a vast number of potential solutions to these problems very quickly, thereby defeating current encryption. The algorithms NIST has standardized are based on different math problems that would stymie both conventional and quantum computers,” it said.
“The three new standards are built for the future,” NIST added. “Quantum computing technology is developing rapidly, and some experts predict that a device with the capability to break current encryption methods could appear within a decade, threatening the security and privacy of individuals, organizations and entire nations.”
Although NIST plans to release additional standards as “back-ups,” it encouraged organizations to begin deploying the three available tools immediately.
“There is no need to wait for future standards,” NIST mathematician Dustin Moody said. “Go ahead and start using these three. We need to be prepared in case of an attack that defeats the algorithms in these three standards, and we will continue working on backup plans to keep our data safe. But for most applications, these new standards are the main event.”
“These finalized standards include instructions for incorporating them into products and encryption systems,” Mr. Moody said. “We encourage system administrators to start integrating them into their systems immediately, because full integration will take time.”
“Quantum computing technology could become a force for solving many of society’s most intractable problems, and the new standards represent NIST’s commitment to ensuring it will not simultaneously disrupt our security,” NIST Director Laurie Locascio said. “These finalized standards are the capstone of NIST’s efforts to safeguard our confidential electronic information.”
At a White House event to discuss the implications of NIST’s work and the threat of quantum computing to national security, National Cyber Director Harry Coker warned that quantum-resistant cryptography needed to be deployed prior to development of quantum capabilities by adversarial foreign nations.
“In the case of quantum computing, the threat isn’t just on the horizon. It’s here now,” Mr. Coker said. “Malicious actors are already using a ‘store now, break later’ strategy, gathering encrypted data today with the intention to decrypt it once they have the quantum capability. This endangers our national security and our future operations.”
“Today we stand at a critical juncture in our efforts to secure the future of our nation and our allies, and as we celebrate the profound gifts of technological progress, it’s important to consider the level of vulnerability that quantum computing potentially exposes us to,” he said.
“These capabilities are projected to break much of our current encryption, leaving significant impacts on our national and economic security and every individual’s right to privacy,” he added. “Given the magnitude and potential impact of the threat, we must act with urgency.”
The Information Technology Industry Council (ITI), which participated in the White House event, issued a statement from Gordon Bitko, ITI’s executive vice president–policy.
“The post quantum cryptography standards unveiled by the White House today are a necessary step in safeguarding everyone’s online activities and communications with robust encryption as quantum computing becomes a reality,” Mr. Bitko said. “It’s important that the National Institute of Standards and Technology (NIST) continues to work closely with industry and other stakeholders as we begin the complex and long-term process of implementing these new standards.”
MainStory: TopStory FederalLegislation DataSecurity DataPrivacy