FIDO Seminar: Evolving Landscape of Post-Quantum Cryptography.pptx

Editor's Notes

• #2: From this source: https://postquantum.com/post-quantum/4099-qubits-rsa/ It’s a figure that crops up in countless discussions about quantum computing and cybersecurity: 4,099 qubits. That’s the widely cited number of quantum bits one would need to factor a 2048-bit RSA key using Shor’s algorithm – in other words, the notional threshold at which a quantum computer could crack one of today’s most common encryption standards. The claim has an alluring simplicity: if we could just build a quantum machine with a few thousand perfect qubits, decades of RSA-protected secrets would fall in seconds. But where does this “4,099 logical qubits” figure actually come from, and what does it really mean? The story behind it reveals both how far quantum algorithms have come and how much further quantum hardware needs to go.
• #6: X is the “security shelf life” (the longest protection interval we care about, assuming that the data is protected starting today)Y is the “migration time” (the time it takes to design build, and deploy the new infrastructure)Z is the “collapse time” (the time it takes for a sufficiently large quantum computer to become operational, starting from today)National Academies of Sciences, Engineering, and Medicine. 2019. Quantum Computing: Progress and Prospects. Washington, DC: The National Academies Press. https://doi.org/10.17226/25196.
• #8: ML-KEM: Module-Lattice-based Key Encapsulation Mechanism (CRYSTALS-Kyber) ML-DSA: Module-Lattice-Based Digital Signature Algorithm (CRYSTALS-Dilithium) Best for TLS/SSL authentication with many connections, code signing for software updates and digital certificates SLH-DSA: Stateless Hash-Based Digital Signature Algorithm (previously SPHINCS) Uses long-lived keys. Good for firmware signing. Apps where absolute highest confidence is needed, even at the cost of performance. It is STATELESS LMS/XMSS: Leighton-Micali Signature / eXtended Merkle Signature Scheme Used for firmware signing, long-lived infrequent signing keys. It is STATEFUL. Faster signing compared to SLH-DSA
• #9: US: IR 8547, Transition to Post-Quantum Cryptography Standards | CSRC CSI_CNSA_2.0_FAQ_.PDF UK: Timelines for migration to post-quantum cryptography - NCSC.GOV.UK EU: Securing Tomorrow, Today: Transitioning to Post-Quantum Cryptography Australia: 22. ISM - Guidelines for cryptography (March 2025).pdf
• #10: With the initial tranche of algorithms standardized, protocol evolution and standards updates have kicked into high gear. The IETF is doing a lot of heavy lifting with certificate management and issuance, as well as the data-in-motion protocols. These efforts will provide the foundational trust and communications protection for everything that relies upon PKI infrastructure. FIDO is updating their allowed cryptography list to include quantum safe algorithms and acceptable security strengths to align with their certification levels, as well as documenting migration strategies. Similarly for Global Platform. ENISA is updating cryptographic guidance which will inform many Common Criteria certification efforts. GSM + ETSI/SAGE are also providing guidance and updating many standards, to include 3GPP & 5G standards
• #11: Algorithm efficiency – the quantum safe algorithms are not drop-in replacements in terms of performance, public key size, or signature size. Hardware Lead-times – the lifecycle of instantiating, optimizing, testing, and producing specialized hardware has a multi-year runway, so solutions which require dedicated hardware will be lagging the algorithm standardization processes. Sovereign differences – despite widespread agreement on some quantum safe algorithms, that agreement is not universal. Furthermore, operational concerns such as the use of hybrid cryptography (i.e. using classic along with the quantum safe algorithms) is not universally agreed. Certification Lead-times – in addition to the certification bodies having to update their standards and testing processes, they also have a natural latency which introduces a delay of certified products into the marketplaces that requirement. Full Supply Chain – it’s not sufficient to just deliver products that are quantum safe – vendors must also ensure their build and delivery pipelines are quantum safe as well. For example, things like code signing, delivery of BOMs to manufacturers, etc. The full supply chain needs a quantum safe story.