As we approach the end of the year, it is a good time to reflect on where you are in your transition to post-quantum cryptography. Have you started? Do you have a plan in place? If so, what does your timeline look like? Most importantly, does it meet the requirements of your customers? If you are not sure what those requirements are, then you will find the following document very enlightening.
NIST (National Institute of Standards and Technology) recently published a document known as IR 8547.
It is titled “Transition to Post-Quantum Cryptography Standards” and gives detailed assessments of the threat from quantum computers including explanations of cryptographic components in software and communications infrastructure and migration to post-quantum cryptography considerations. The document is only 20 pages and the language is very accessible even to the layman; no Ph.D required.
The most notable guidance within this document is section 4 titled “Towards a PQC Standards Transition Timeline”. It begins by referencing National Security Memorandum 10 (NSM-10) which was issued by the Whitehouse. Directly quoting from it:
“Any digital system that uses existing public standards for public?key cryptography, or
that is planning to transition to such cryptography, could be vulnerable to an attack by a
Cryptographically Relevant Quantum Computer (CRQC). To mitigate this risk, the United
States must prioritize the timely and equitable transition of cryptographic systems to
quantum-resistant cryptography, with the goal of mitigating as much of the quantum
risk as is feasible by 2035.”
To summarize the rest of the section, ECDSA, EdDSA, RSA, FFDH, and ECDH are all disallowed for usage by 2035. By then, their post-quantum counterparts – ML-DSA, SLH-DSA, LMS, XMSS, and ML-KEM – should be used in their place. 2035 is only 10 years away. How does that fit in with your product development cycle and cryptographic certification timelines?
Perhaps there will be some exceptions, but likely those will be hard to come by, expensive, and require long processing time as they will be on a case-by-case basis. The better situation to be in is to simply be ready and have completed your migration to post-quantum cryptography.
Want to get started? We at wolfSSL are very proud that we already have post-quantum algorithms implemented and you can try them out in wolfSSL, wolfSSH, wolfMQTT and wolfBoot! Go ahead and get started to better understand how these new algorithms will affect your products and your customer’s user experience!
If you have questions about any of the above, please contact us at facts@wolfSSL.com or +1 425 245 8247.
Download wolfSSL Now
