Reference / Paper · 2024
NIST IR 8547 (initial public draft) — Transition to Post-Quantum Cryptography Standards
NIST's schedule for deprecating RSA and other factoring-based schemes.
Reference / Paper · 2024
NIST's schedule for deprecating RSA and other factoring-based schemes.
NIST Internal Report NIST IR 8547 ipd Transition to Post-Quantum Cryptography Standards Initial Public Draft Dustin Moody Ray Perlner Andrew Regenscheid Angela Robinson David Cooper This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8547.ipd NIST Internal Report NIST IR 8547 ipd Transition to Post-Quantum Cryptography Standards Initial Public Draft Dustin Moody Ray Perlner Andrew Regenscheid Angela Robinson David Cooper Computer Security Division Information Technology Lab This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8547.ipd November 2024 U.S. Department of Commerce Gina M. Raimondo, Secretary National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax Publication History Approved by the NIST Editorial Review Board on YYYY-MM-DD [Will be added to final publication.] How to Cite this NIST Technical Series Publication Moody D, Perlner R, Regenscheid A, Robinson A, Cooper D (2024) Transition to Post-Quantum Cryptography Standards. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Internal Report (IR) NIST IR 8547 ipd. https://doi.org/10.6028/NIST.IR.8547.ipd Author ORCID iDs David Cooper: 0009-0001-2410-5830 Dustin Moody: 0000-0002-4868-6684 Ray Perlner: 0000-0001-8793-2238 Andrew Regenscheid: 0000-0002-3930-527X Angela Robinson: 0000-0002-1209-0379 Public Comment Period November 12, 2024 – January 10, 2025 Submit Comments [email protected] National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Additional Information Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8547/ipd, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 1 Abstract 2 3 4 5 6 7 This report describes NIST’s expected approach to transitioning from quantum-vulnerable cryptographic algorithms to post-quantum digital signature algorithms and key-establishment schemes. It identifies existing quantum-vulnerable cryptographic standards and the quantumresistant standards to which information technology products and services will need to transition. It is intended to foster engagement with industry, standards organizations, and relevant agencies to facilitate and accelerate the adoption of post-quantum cryptography. 8 Keywords 9 cryptography; post-quantum cryptography; public key cryptography; quantum computing. 10 Reports on Computer Systems Technology 11 12 13 14 15 16 17 18 The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. i NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 19 Call for Patent Claims 20 21 22 23 24 25 26 This public review includes a call for information on essential patent claims (claims whose use would be required for compliance with the guidance or requirements in this Information Technology Laboratory (ITL) draft publication). Such guidance and/or requirements may be directly stated in this ITL Publication or by reference to another publication. This call also includes disclosure, where known, of the existence of pending U.S. or foreign patent applications relating to this ITL draft publication and of any relevant unexpired U.S. or foreign patents. 27 28 ITL may require from the patent holder, or a party authorized to make assurances on its behalf, in written or electronic form, either: 29 30 a) assurance in the form of a general disclaimer to the effect that such party does not hold and does not currently intend holding any essential patent claim(s); or 31 32 33 b) assurance that a license to such essential patent claim(s) will be made available to applicants desiring to utilize the license for the purpose of complying with the guidance or requirements in this ITL draft publication either: 34 35 i. under reasonable terms and conditions that are demonstrably free of any unfair discrimination; or 36 37 ii. without compensation and under reasonable terms and conditions that are demonstrably free of any unfair discrimination. 38 39 40 41 42 Such assurance shall indicate that the patent holder (or third party authorized to make assurances on its behalf) will include in any documents transferring ownership of patents subject to the assurance, provisions sufficient to ensure that the commitments in the assurance are binding on the transferee, and that the transferee will similarly include appropriate provisions in the event of future transfers with the goal of binding each successor-in-interest. 43 44 The assurance shall also indicate that it is intended to be binding on successors-in-interest regardless of whether such provisions are included in the relevant transfer documents. 45 Such statements should be addressed to: [email protected] ii NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 46 Table of Contents 47 1. Introduction ...................................................................................................................................1 48 49 50 2. Background ....................................................................................................................................3 51 52 2.1.1. Digital Signature Algorithms ......................................................................................................... 3 53 2.1.2. Key Establishment ........................................................................................................................ 4 54 2.1.3. Symmetric Cryptography .............................................................................................................. 4 55 56 2.2.1. Network Protocol and Security Technology Standards ................................................................ 5 57 2.2.2. Software Cryptographic Libraries ................................................................................................. 5 58 2.2.3. Cryptographic Hardware .............................................................................................................. 6 59 2.2.4. PKI and Other Infrastructure Components .................................................................................. 6 60 2.2.5. IT Applications and Services ......................................................................................................... 6 61 3. Migration Considerations ...............................................................................................................7 62 63 3.1.1. Code Signing ................................................................................................................................. 7 64 3.1.2. User and Machine Authentication ............................................................................................... 7 65 3.1.3. Network Security Protocols .......................................................................................................... 8 66 3.1.4. Email and Document Signing and Encryption .............................................................................. 8 67 68 3.2.1. Hybrid Key-Establishment Techniques ......................................................................................... 9 69 3.2.2. Hybrid Digital Signature Techniques .......................................................................................... 10 70 4. Towards a PQC Standards Transition Timeline...............................................................................11 71 72 4.1.1. Digital Signatures ........................................................................................................................ 13 73 4.1.2. Key Establishment ...................................................................................................................... 14 74 4.1.3. Symmetric Cryptography ............................................................................................................ 15 75 76 References.......................................................................................................................................18 77 Appendix A. Glossary .......................................................................................................................20 78 iii NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 79 List of Tables 80 Table 1: Post-Quantum Security Categories ......................................................................................12 81 Table 2: Quantum-vulnerable digital signature algorithms ................................................................13 82 Table 3. Post-quantum digital signature algorithms ..........................................................................13 83 Table 4: Quantum-vulnerable key-establishment schemes ................................................................14 84 Table 5: Post-quantum key-establishment schemes ..........................................................................15 85 Table 6: Block ciphers.......................................................................................................................15 86 Table 7: Hash functions and XOFs .....................................................................................................16 87 iv NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 88 1. Introduction 89 90 91 92 93 94 95 Cryptographic algorithms are vital for safeguarding confidential electronic information from unauthorized access. For decades, these algorithms have proved strong enough to defend against attacks using conventional computers that attempt to defeat cryptography. However, future quantum computing may be able to break these algorithms, rendering data and information vulnerable. Countering this future quantum capability requires new cryptographic methods that can protect data from both current conventional computers and the quantum computers of tomorrow. These methods are referred to as post-quantum cryptography (PQC). 96 97 98 99 100 101 102 103 In response, NIST has released three PQC standards to start the next and significantly large stage of working on the transition to post-quantum cryptography: the Module-Lattice-Based Key-Encapsulation Mechanism [FIPS203], the Module-Lattice-Based Digital Signature Algorithm [FIPS204], and the Stateless Hash-Based Signature Algorithm [FIPS205]. Historically, the journey from algorithm standardization to full integration into information systems can take 10 to 20 years. This timeline reflects the complexity of companies building the algorithms into products and services, procuring those products and services, and integrating those products and services into technology infrastructures. 104 105 106 107 108 109 110 Even though the transition to post-quantum cryptography is starting before a cryptographically relevant quantum computer has been built, there is a pressing threat. Encrypted data remains at risk because of the “harvest now, decrypt later” threat in which adversaries collect encrypted data now with the goal of decrypting it once quantum technology matures. Since sensitive data often retains its value for many years, starting the transition to post-quantum cryptography now is critical to preventing these future breaches. This threat model is one of the main reasons why the transition to post-quantum cryptography is urgent. 111 1.1. Scope and Purpose 112 113 114 115 116 117 118 Updating cryptographic technology has occurred many times at different scales, such as increasing key sizes or phasing out insecure hash functions and block ciphers. While the transition to PQC is unprecedented in scale, it benefits from a level of awareness and understanding that previous cryptographic changes did not have. NIST recognizes the complexity of migrating the vast array of systems that currently rely on public-key cryptography and acknowledges that this transition will demand substantial effort across diverse applications and infrastructures with specific requirements and constraints. 119 120 121 122 123 124 125 This report serves as the initial step in a broader strategy to manage and guide the transition to post-quantum cryptography. This transition will involve the adoption of new PQC algorithms as well as the careful deprecation, controlled legacy use, and eventual removal of quantumvulnerable algorithms that are currently widespread in technological infrastructures. Publicprivate engagement will be crucial on the path toward PQC. Additionally, this report continues NIST’s ongoing dialogue with industry, standards organizations, and relevant agencies to develop a clear roadmap and realistic timeline for transitioning to PQC. NIST is committed to 1 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 126 127 ensuring that this transition is as smooth and coordinated as possible, balancing the urgency of adopting PQC with the need to minimize disruption across critical systems. 128 1.2. Audience 129 130 131 132 133 134 135 This document is intended for a broad audience, including federal agencies, technology providers, standards organizations, and Cryptographic Module Validation Program (CMVP) laboratories. These groups play a critical role in preparing for the migration to PQC by developing, implementing, and standardizing the new cryptographic methods necessary to secure information in the era of quantum computing. This document should inform these stakeholder’s efforts and timelines for migrating information technology products, services, and infrastructure to PQC. 2 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 136 2. Background 137 2.1. Cryptographic Standards 138 139 140 141 142 143 144 Federal Information Processing Standards (FIPS) and the NIST Special Publication (SP) 800-series specify a broad set of cryptographic primitives, algorithms, and schemes, including many publickey cryptosystems that will be deprecated and ultimately disallowed as part of the transition to post-quantum cryptography. This section identifies quantum-vulnerable algorithms in NIST’s existing cryptographic standards as well as the post-quantum algorithm standards that have been recently published. Section 4.1 provides the transition plan for the quantum-vulnerable algorithms in these standards. 145 2.1.1. Digital Signature Algorithms 146 147 148 149 Digital signature algorithms are used to provide identity authentication, integrity authentication, source authentication, and support for non-repudiation. Digital signature algorithms are used in conjunction with hash functions or eXtendable-Output Functions (XOFs) to sign messages of arbitrary length. 150 151 152 153 154 155 156 157 NIST-approved digital signature algorithms were historically specified in FIPS 186 [FIPS186]. The current revision of FIPS 186 specifies the Elliptic Curve Digital Signature Algorithm (ECDSA) and adopts the RSA algorithm specified in RFC 8017 and PKCS 1 (version 1.5 and higher) and the Edwards-Curve Digital Signature Algorithm (EdDSA) specified in RFC 8032. The related SP 800186 [SP800186] specifies the elliptic curves to be used with ECDSA and the elliptic curve cryptography (ECC) based key establishment schemes in SP 800-56A [SP80056A]. These algorithms are vulnerable to Shor’s Algorithm on a cryptographically relevant quantum computer. 158 159 160 161 FIPS 204 and 205 each specify quantum-resistant digital signature schemes. FIPS 204 specifies the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) [FIPS204], which is derived from the CRYSTALS-Dilithium submission. FIPS 205 specifies the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA), which is derived from the SPHINCS+ submission [FIPS205]. 162 163 164 165 166 167 168 169 170 SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes, specifies two stateful hash-based signature (HBS) schemes — the Leighton-Micali Signature (LMS) system and the eXtended Merkle Signature Scheme (XMSS) — along with their multi-tree variants, the Hierarchical Signature System (HSS) and multi-tree XMSS (XMSSMT) [SP800208]. These schemes are also resistant to attacks by quantum computers. In stateful hash-based signature (HBS) schemes, the HBS private key consists of a large set of one-time signature (OTS) private keys. The security of these schemes relies on the signer to ensure that no individual OTS key is ever used to sign more than one message. Due to this need to maintain state, HBS schemes are not intended for general use. 171 172 173 In the future, NIST intends to develop a FIPS that specifies a digital signature algorithm derived from FALCON as an additional alternative to these standards. In addition, NIST is evaluating other proposed digital signature algorithms for possible standardization through the Additional 3 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 174 175 Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process [NISTIR8528]. 176 2.1.2. Key Establishment 177 178 179 180 181 Key establishment is the means by which keys are generated and provided to the entities that are authorized to use them. Current NIST-approved key-establishment schemes are specified in SP 800-56A, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm-Based Cryptography [SP80056A], and SP 800-56B, Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography [SP80056B]. 182 183 184 SP 800-56A specifies key-establishment schemes based on the discrete logarithm problem over finite fields and elliptic curves, including several variations of Diffie-Hellman and Menezes-QuVanstone (MQV) key establishment schemes. 185 186 SP 800-56B specifies key-establishment schemes based on the RSA public key cryptosystem. This publication includes approved methods for both key agreement and key transport. 187 188 189 190 191 192 FIPS 203 specifies a cryptographic scheme called Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), which is derived from the CRYSTALS-KYBER submission. A keyencapsulation mechanism (KEM) is a particular type of key-establishment scheme that can be used to establish a shared secret key between two parties communicating over a public channel. The fourth round of the NIST PQC Standardization process is evaluating additional KEM algorithms, and NIST anticipates selecting one or more alternatives to ML-KEM in the future. 193 2.1.3. Symmetric Cryptography 194 195 196 197 198 199 200 201 202 Symmetric-key algorithms (sometimes called secret-key algorithms) use a single key to both apply cryptographic protection and to remove or check the protection (i.e., the same key is used for a cryptographic operation and its inverse). For example, the key used to encrypt data (i.e., apply protection) is also used to decrypt the encrypted data (i.e., remove the protection). In the case of encryption, the original data is called the plaintext, while the encrypted form of the data is called the ciphertext. The key must be kept secret if the data is to remain protected. Several classes of symmetric-key algorithms have been approved: those based on block cipher algorithms (e.g., AES) and those based on the use of hash functions (e.g., a keyed-hash message authentication code based on a hash function). 203 Symmetric-key algorithms are used for: 204 • Block ciphers 205 • Hash functions 206 • Encryption using block cipher modes of operation 207 • Data authentication using block cipher modes of operation 208 • Data authentication using key-hash constructions 4 NIST IR 8547 ipd (Initial Public Draft) November 2024 209 • Key derivation 210 • Key wrapping 211 • Random bit generation Transition to Post-Quantum Cryptography Standards 212 213 214 As discussed in Sec. 4.1.3, the existing algorithm standards for symmetric cryptography are less vulnerable to attacks by quantum computers. NIST does not expect to need to transition away from these standards as part of the PQC migration. 215 2.2. Cryptographic Technologies and Components 216 217 218 219 220 221 222 223 224 225 Once PQC algorithms have been standardized, applications will need to be modified to make use of them. Many applications include components that are based on standardized protocols and security technologies that will need to be revised to support the use of the PQC algorithms. In addition, applications are built on top of software cryptographic libraries that either provide the implementations of the cryptographic algorithms or provide an interface to hardware cryptographic modules. Any software cryptographic libraries and hardware cryptographic modules used by an application will also need to be revised to support the PQC algorithms. Applications may also rely upon infrastructure components, such as public key infrastructures (PKI), that would need to be updated to support the PQC algorithms before the applications themselves can migrate to using the PQC algorithms. 226 2.2.1. Network Protocol and Security Technology Standards 227 228 229 230 Network protocols and security technology standards define the rules for data exchange over networks and ensure secure and reliable communication. Examples include Transport Layer Security (TLS), Secure Shell (SSH), Internet Protocol Security (IPsec), and Cryptographic Message Syntax (CMS). 231 232 233 234 235 236 237 These protocols and security technologies often rely on classical cryptographic algorithms that are vulnerable to quantum attacks. Updating them to incorporate PQC algorithms is essential to maintaining data confidentiality and integrity. This involves revising protocol specifications to support new key exchange mechanisms and authentication methods that are quantumresistant. In some cases, this will involve simply assigning an identifier for the new algorithm. In other cases, more significant changes will be required to accommodate the larger sizes of the PQC algorithms or as a result of the new algorithms having different interfaces. 238 2.2.2. Software Cryptographic Libraries 239 240 241 242 243 Software cryptographic libraries are collections of cryptographic algorithms and protocols that are implemented in software to provide essential cryptographic functions to applications. OpenSSL, BoringSSL, Libsodium, and the Java Cryptography Architecture (JCA) are a few examples of cryptographic libraries that are used to provide cryptographic support for applications. 5 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 244 245 246 247 248 These libraries need to incorporate PQC algorithms that are standardized by bodies like NIST. Updating them ensures that developers have access to quantum-resistant cryptographic functions without implementing complex algorithms themselves. This transition involves adding new algorithms, optimizing their implementations for performance, and ensuring those implementations are secure against side-channel attacks. 249 2.2.3. Cryptographic Hardware 250 251 252 253 Cryptographic hardware modules, such as hardware security modules (HSMs) and Trusted Platform Modules (TPMs), provide secure environments for performing cryptographic operations and storing sensitive keys. They are used in various applications, from securing server infrastructure to protecting cryptographic keys on personal devices. 254 255 256 257 258 Hardware modules must be upgraded or redesigned to support PQC algorithms, which often have larger key sizes and different computational requirements. This includes updating firmware or hardware to handle new algorithms and ensuring that the modules can perform quantum-resistant cryptographic operations efficiently while maintaining the high security standards expected of these devices. 259 2.2.4. PKI and Other Infrastructure Components 260 261 262 263 Public key infrastructure (PKI) systems manage digital certificates and public-private key pairs to enable secure communication and authentication across networks. Other infrastructure components include certification authorities (CAs), registration authorities, key management systems, and directory services. 264 265 266 267 268 269 PKI components must be updated to issue, distribute, and manage certificates that use PQC algorithms and to sign certificates and revocation status information using PQC algorithms. This includes supporting new cryptographic algorithms in certificate issuance processes and modifying validation and revocation mechanisms. Ensuring backward compatibility and interoperability during the transition period is crucial to maintaining trust and security across the network. 270 2.2.5. IT Applications and Services 271 272 273 274 IT applications and services encompass a wide array of software and platforms used by organizations, including web applications, databases, communication tools, cloud services, and enterprise software. These applications rely on cryptography for securing data, authenticating users, and ensuring secure transactions. 275 276 277 278 279 Applications and services must be modified to support PQC algorithms for encryption, digital signatures, and key exchange. This requires updating the underlying cryptographic implementations, adjusting to changes in key sizes and algorithm performance, and ensuring compatibility with updated protocols and libraries. Developers need to refactor code, conduct extensive testing, and potentially redesign user interfaces to accommodate these changes. 6 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 280 3. Migration Considerations 281 282 283 284 Even though there are no existing cryptographically relevant quantum computers that currently threaten levels of security, it will take a significant amount of time to transition to new postquantum algorithms. Past cryptographic migrations have taken over a decade, and this more complex migration will likely take at least that long. 285 286 287 288 289 290 291 292 293 294 295 Mosca’s theorem emphasizes the urgency of migrating to post-quantum algorithms by introducing a simple but powerful timeline: if “X” represents the number of years that data must be kept secure, and “Y” is the estimated time needed to complete the transition, then organizations must start transitioning to post-quantum algorithms before X + Y exceeds the expected time Z for a cryptographically relevant quantum computer to be built. This means that even if quantum computers are a decade away, organizations must begin the migration to postquantum cryptography today to avoid having their encrypted data exposed once quantum computers become operational in the future. This threat, often referred to as “harvest now, decrypt later,” underscores the necessity of acting immediately, especially for data with longterm sensitivity, such as government secrets or medical records. Ensuring security today will safeguard it for the future. 296 3.1. Use Cases 297 3.1.1. Code Signing 298 299 300 301 Code signing involves digitally signing executables and software packages to verify the author’s identity and ensure that the code has not been tampered with. This process is critical for maintaining trust in software distribution channels and preventing the spread of malicious code. 302 303 304 305 306 307 The devices that install and execute this code need the ability to verify the signatures on the code. In some cases, it is not feasible to update the code that performs the signature verification after the devices have been manufactured. When this is the case, it is important for the devices to be designed to require quantum-resistant signatures on the executables, if there is a risk that the devices will still be in use after cryptographically relevant quantum computers become available. 308 3.1.2. User and Machine Authentication 309 310 311 312 313 User and machine authentication systems verify identities to control access to resources. This often involves cryptographic protocols that use asymmetric algorithms for secure key exchange and authentication, ensuring that only authorized users or devices can access sensitive data or services. Depending on the protocol, authentication may be performed using either a digital signature algorithm or a key-establishment scheme. 314 315 316 Unlike with encryption, where there is a threat of “harvest now, decrypt later,” an authentication system remains secure as long as the cryptographic algorithms and keys used to perform the authentication are secure when the authentication is performed. Authentication 7 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 317 318 319 systems may continue to use quantum-vulnerable algorithms until quantum computers that are capable of breaking current, quantum-vulnerable algorithms become available, at which point authentication using these algorithms will need to be disabled. 320 321 322 323 Supporting quantum-resistant algorithms for authentication will require upgrades to both the system performing and accepting the authentication, as well as to any supporting infrastructure, such as a PKI. It may also require obtaining hardware cryptographic tokens that support the quantum-resistant algorithms. 324 3.1.3. Network Security Protocols 325 326 327 Network security protocols like TLS and virtual private networks secure data transmission over public networks. They use cryptographic techniques to provide confidentiality, integrity, and authentication between communicating parties. 328 329 330 331 332 Modern network security protocols tend to use separate asymmetric keys for key establishment and authentication. While long-term keys are used for authentication, keyestablishment keys are used for a short period of time, usually for a single key establishment. This provides the property of forward secrecy, where the compromise of a long-term key does not result in the compromise of communication sessions that occurred before the compromise. 333 334 335 336 337 As symmetric keys that are established through the key-establishment process are used to provide confidentiality, the “harvest now, decrypt later” threat needs to be considered when determining a migration timeline for the key-establishment scheme. The cryptographic algorithm used for authentication may be transitioned at a different time, and for that the considerations in Sec. 3.1.2 apply. 338 3.1.4. Email and Document Signing and Encryption 339 340 341 342 Email and document signing employ digital signatures to verify the authenticity and integrity of electronic communications and documents. Common algorithms like RSA and ECDSA are widely used to create a cryptographic binding between the content and the sender’s identity, ensuring that the message has not been altered and that it originates from a legitimate source. 343 344 345 346 347 Secure/Multipurpose Internet Mail Extensions (S/MIME) is a standard for public-key encryption and the signing of MIME data. It provides end-to-end encryption and authentication for email and file exchanges to ensure that only intended recipients can access the content. As with other applications providing data confidentiality, email encryption is subject to “harvest now, decrypt later.” 348 3.2. PQC-Classical Hybrid Protocols 349 350 351 352 The migration to post-quantum cryptography may initially include hybrid solutions that incorporate the use of quantum-resistant and quantum-vulnerable algorithms when establishing cryptographic keys or generating digital signatures. These hybrid solutions are typically designed to remain secure if at least one of the component algorithms is secure. 8 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 353 354 355 356 357 358 359 Such hybrid solutions are often utilized as a hedge against a cryptographic or implementation flaw in one of the underlying component algorithms. It may also provide a path for accommodating the use of PQC if sector-specific requirements still require legacy quantumvulnerable algorithms. However, hybrid solutions add complexity to implementations and architectures, which can increase security risks and costs during the transition to PQC. When used, hybrid solutions are typically expected to be temporary measures that lead to a second transition to cryptographic tools that use only PQC algorithms. 360 361 362 363 These trade-offs will vary based on the hybrid techniques used, the applications involved, and the vendor and user communities that will develop and deploy them. Implementers and standards organizations that specify cryptographic protocols and technologies need to carefully consider the security, costs, and complexity of hybrid solutions in their environments. 364 365 366 367 Industry and standards organizations are considering a variety of techniques for hybrid solutions with key-establishment schemes and digital signatures. NIST intends to accommodate the use of hybrid techniques in its cryptographic standards to facilitate the transition to PQC where their use is desired. 368 369 370 371 372 373 374 375 376 377 Whether hybrid solutions are used or not, quantum-vulnerable and quantum-resistant cryptographic algorithms will be fielded and used alongside each other in many applications and systems during the transition to PQC to facilitate interoperability. For example, many network security protocols support the use of multiple sets of cryptographic algorithms and allow two communicating parties to negotiate which algorithms to use in each session. Similarly, during the transition to PQC, public key infrastructures using quantum-vulnerable digital signature algorithms are expected to be deployed and used alongside those using quantum-resistant algorithms. Such approaches are not considered hybrid solutions if each session only uses a single cryptographic algorithm for key establishment and/or digital signatures. 378 3.2.1. Hybrid Key-Establishment Techniques 379 380 381 382 A hybrid key-establishment mode is defined here to be a key establishment scheme that is a combination of two or more components that are themselves cryptographic key-establishment schemes. The hybrid key-establishment scheme becomes a composite of these component schemes. 383 384 385 386 387 NIST currently allows a generic composite key-establishment technique described in SP 800-56C [SP80056C]. Assume that the value Z is a shared secret that was generated as specified by SP 800-56A or 800-56B and that a shared secret T is generated or distributed through other schemes. The value Z’=Z||T may then be treated as a shared secret and any of the key derivation methods given in SP 800-56C may be applied to Z’ to derive secret keying material. 388 389 390 391 392 NIST intends to update SP 800-56C so that the value Z may be generated as specified by any current and future NIST key-establishment standards. This will include SP 800-56A, SP 800-56B, FIPS 203, and any additional post-quantum key-establishment standards. The desired property of hybrid techniques is that derived keys remain secure if at least one of the component schemes is secure. Security properties can be complex, and for composite key establishment 9 NIST IR 8547 ipd (Initial Public Draft) November 2024 Transition to Post-Quantum Cryptography Standards 393 394 395 schemes they will need to be analyzed on a case-by-case basis with the requirements of the application in mind. NIST intends to offer guidance on various key combiners in the forthcoming SP 800-227, Recommendations for Key Encapsulation Mechanisms. 396 397 398 399 400 Additionally, the output of the key-establishment scheme specified in FIPS 203 is a shared secret key which is a shared secret that does not require further key derivation. NIST emphasizes that any shared secret key generated as specified in FIPS 203 may be used as the value Z in the generic composite mode described in SP 800-56C. These same properties will apply to any future FIPS which standardize KEMs. 401 3.2.2. Hybrid Digital Signature Techniques 402 403 404 405 406 Common techniques for hybrid digital signatures involve the use of dual signatures, which consist of two or more signatures on a common message. It may also be known as a hybrid signature or composite signature. The verification of the dual signature requires all of the component signatures to be successfully verified, such as by creating a single logical composite signature from two or more component signature algorithms. 407 408 409 410 Dual signatures could be used to sign user data (e.g., a document or e-mail) or digital certificates that contain references to user key pairs within a PKI. Existing NIST standards and guidelines accommodate their use provided that at least one component digital signature algorithm is NIST-approved. 411 412 413 414 415 416 NIST leaves the decision to each specific application as to whether it can afford the implementat