NIST Seeks Public Feedback to Draft Guide on Migration to PQC

The National Cybersecurity Center of Excellence (NCCoE) has released a preliminary guide on practices for migrating from legacy cryptography to quantum-resistant cryptography and is seeking comments from industry, government, and academia. The draft document, NIST Special Publication (SP) 1800-38a, Migration to Post-Quantum Cryptography, is open for comment until June 8, 2023.

The NCCoEE is part of the National Institute of Standards and Technology (NIST), which is working on standardizing quantum-resistant public-key cryptographic algorithms. The NCCoEE intends to revise the preliminary migration draft based on feedback and will release more volumes for comment to encourage the widespread adoption of quantum-resistant cryptography.

The NCCoE has stated that advances in quantum computing may pose a threat to current cryptographic algorithms used for digital information protection. To protect data and systems from possible quantum computer-based attacks, it is crucial to plan for the replacement of hardware, software, and services using affected algorithms. The organization is seeking feedback on necessary workstreams for transitioning to quantum-resistant solutions and identifying gaps between post-quantum algorithms and their integration into protocol implementations to accelerate the adoption and deployment of post-quantum cryptography (PQC).

The agency advises that legacy cryptography currently in use, including RSA, Elliptic Curve Diffie-Hellman, and Elliptic Curve Digital Signature Algorithm (ECDSA), should be updated, replaced, or adjusted significantly to accommodate the use of new quantum-resistant algorithms.

The new algorithms are not expected to function as direct replacements for quantum-vulnerable algorithms. Differences in various aspects such as key size, signature size, error handling, number of execution steps, and key establishment process complexity may result in varying performance and reliability characteristics. It is also possible that organizations may not have a comprehensive understanding of the extent to which they rely on legacy cryptography across their operations. Given the possible lack of visibility, the NCCoE recommends starting to take inventory of cryptography usage and identifying vulnerable legacy cryptography, along with associated data and interdependencies.

Using discovery tools will aid to detect and report the use of cryptographic algorithms that are vulnerable to both quantum and non-quantum attacks. Careful planning is needed to maintain connectivity and interoperability during the transition from quantum-vulnerable to quantum-resistant algorithms. In addition, organizations may not have complete control over their cryptographic mechanisms and processes, which will result in intense manual effort for making accurate alterations.

The NCCoE plans to develop recommended practices for algorithm replacement in future phases, which may require interim hybrid implementations to maintain interoperability during migration. They welcome feedback from the PQC community to identify future workstreams that will speed up the adoption and deployment of PQC.

The draft was prepared by William Newhouse and Murugiah Souppaya from NIST, William Barker from Dakota Consulting, and Chris Brown from The MITRE Corporation. Click here for the draft. Comments can be submitted via a web form on the project page until just before midnight on June 8, 2023.

Cryptomathic's Crypto Service Gateway delivers a comprehensive crypto-agility security solution that allows organizations to prepare for the post-quantum era with ease. Contact us now to learn how this cutting-edge technology can help you protect your critical information today.

Download the eBook Preparing for the Rise of Quantum Computing: with a crypto agility strategy