New Encryption Standards Protect Against Post-Quantum Attacks

The National Institute of Standards and Technology (NIST) is in the final stages of standardizing quantum-proof encryption algorithms, which federal agencies will be required to adopt to protect against quantum-based cyberattacks.

“We’re still writing the standards. They’ll probably come out in about a year,” Dustin Moody, mathematician in the NIST Computer Security Division, told GovCIO Media & Research in an interview. “But we very much encourage people to be planning ahead, knowing that these algorithms or these standards are coming out, and to prepare as much as possible for this transition.”

Over the past six years, NIST ran a worldwide competition soliciting teams to design the strongest encryption algorithms possible. After several years of analysis and evaluation, NIST picked four algorithms from which to develop post-quantum cryptography data security standards. As soon as the standards are published, federal agencies will encrypt their data using post-quantum cryptography.

A quantum computer, which could revolutionize industries such as finance and health care, could also break current encryption standards and expose vast swaths of sensitive data ranging from patient privacy to national security. A quantum computer does not exist yet, but federal agencies could already be at risk from future quantum attacks. Adversaries are holding onto encrypted data that has no shelf life and is ready to be decrypted once they have access to a quantum computer.

“The National Security Agency is well aware of the quantum threat,” Moody said. “This isn’t catching them by surprise, but at the same time, it’s going to take a long time to migrate to quantum-resistant solutions, and so they have to start a lot sooner than anyone else.”

The White House recently signed the Quantum Computing Preparedness Act into law, requiring federal agencies to inventory all technology systems vulnerable to quantum cyber threats. The Office of Management and Budget (OMB) will develop guidance on executive agencies’ transition to quantum-resistant cryptography.

The NIST National Cybersecurity Center of Excellence is also running a project called Migration to Post-Quantum Cryptography. It will partner with agencies such as the Department of Homeland Security and industry partners to develop guidance, reports and tools that organizations and companies can use to help them do their inventory and migrate from the current set of public-key cryptographic algorithms to quantum-resistant algorithms.

“These are the steps that you need to be thinking about and how you can prepare now, even though we don’t have the standards published quite yet,” Moody said.

Meanwhile, DARPA Program Manager Joe Altepeter is working on two initiatives called called “Quantum Benchmarking” and “Underexplored Systems for Utility-Scale Quantum Computing.” The primary goal of both programs is to reduce surprise and uncertainty around quantum technology.

“I can’t think of a bigger source for possible surprise than a technology where we are pretty sure that how good it’s going to be is going to fall somewhere between totally transformative and amazing and useless. It’s somewhere in that range, between most important and nothing,” Altepeter told GovCIO Media & Research in a CyberCast interview last year.

The Quantum Benchmarking program is focused on creating benchmarks to quantitatively measure progress toward transformational computational challenges. The Underexplored Systems for Utility-Scale Quantum Computing program will determine if there is a path to a quantum computer capable of achieving utility-scale operation faster than predicted.

“We are hoping that companies, organizations will engage with us who think they really know how to build a big useful quantum computer, and we want to give them an opportunity to prove it and work with them in a sort of rigorous collaborative verification validation plan to make sure we understand ‘is there a surprising path to get one of these machines that’s faster than people think?'” Altepeter said.

Improving the error rate is one of the many breakthroughs needed before a working large-scale quantum computer is possible, Moody added.

“We’re just kind of starting to get to that point where we can see practical use cases. With regards to how big they need to be until they threaten cryptography, we’re still a ways off from that right now,” he said. “None of the quantum computers that are being built come anywhere close to threatening current security levels. But it’s estimated that that could change within a decade or 15 years, that progress could happen that would threaten the cryptosystems that we have today.”