The Quantum Leap: Preparing for Post Quantum Cryptography Featuring Utimaco Inc.
Welcome to the PCI Security Standards Council’s blog series, The Quantum Leap: Preparing for Post Quantum Cryptography. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry stakeholders to share information about how they are taking steps to ensure their systems are crypto-agile into the future.
Quantum computers are computing systems that operate in very different ways to classical computers, using quantum bits (or ‘qubits’) rather than the classical ‘bits’ of an existing computer. Quantum computing threatens some forms of cryptography, as it allows for operations that are not possible with traditional computing systems and therefore were not considered threats when creating traditional encryption algorithms. As continual progress is being made on quantum computers, it is generally expected to be only a matter of time before ‘cryptographically relevant quantum computers’ (CRQC) can be used to attack some of the widely deployed cryptographic systems used today.
In this edition of The Quantum Leap, Utimaco Inc. Cryptographer, Jillian Benedick, offers insight into how her company is preparing for migration to post-quantum cryptography, the challenges our industry faces, and advice for maintaining strong cryptography practices to protect the future of payment security.
What steps is your organization taking to prepare for a migration to post-quantum cryptography? If it is too soon yet to address within your environment, what will the catalyst be for action?
Utimaco is engaging in various efforts to prepare for the migration to post-quantum cryptography (PQC). Specifically, for the Atalla Payment HSM, we began by testing various algorithms and implementations. We currently have ML-DSA available for use within the HSM Personality (key generation, signing, verifying). Some of the other features, like PQ-TLS, etc. are on the roadmap.
What kind of previous impactful technological change or business shift would you compare to quantum computing?
I think a lot of people want to compare Q-Day to Y2K, but I think that is a poor comparison. Y2K was supposed to be this sudden catastrophic event causing a simultaneous break at the turn of the millennium. Q-Day won’t be so immediate or so loud. Likely, when first achieved, it will play out quietly without public awareness. The big catastrophic event happens later when the public becomes keen and loses trust in their digital world.
I’d compare this change to the development of computers and the internet. With the development of the computer, we gained new ways to collect and analyze data. With that shift, data itself became currency. The computer allowed for the development of the internet, which opened up global communication. Initially, both generated mistrust from the public from fears surrounding job displacement to privacy and data security concerns – though the computers have changed, the skepticisms have not shifted too far. If we look at the impact of computers and the internet on how we work, it is obvious that computers allowed society to shift from jobs that required manual labor to more knowledge-based positions.
Our entire modern world is built on technology and data. This infrastructure is about to become destabilized, and once any cracks show, public trust will also begin to deteriorate. The fall of classical asymmetric cryptography and the loss of public trust is the catastrophe. However, if we look past that initial cryptographic impact, once systems are secured again and trust begins to be restored, then quantum computing will have a lasting impact on every industry. It will likely shift how we organize around work, and certainly how we interact with data. I think the quantum revolution and the AI revolution are occurring simultaneously, and society will come out on the other side looking quite different.
What aspect of migrating to post-quantum cryptography do you see as being the most challenging?
There are four main areas of concern:
Size constraints – Post-Quantum Cryptography Algorithms that have been standardized by NIST, and others have much larger keys, signatures, and certificates than their classical counterparts. With larger keys come challenges like increased computational overhead with slower computational speeds, more memory requirements, and possible buffer overflow issues.
Lagging standards – While algorithms have been standardized, this is just the first step in the process. Everyone is keen to implement the algorithms, but without the supporting infrastructure we run into interoperability problems. Many of the supporting standards still need to be updated or defined for use with Post-Quantum Cryptography Algorithms. We currently lack standards for key management, asymmetric key blocks, and other protocols. It’s crucial to have the supporting standards for the industry in place prior to implementation so that we ensure security, compliance, and interoperability.
Implementation errors – Commonly, with libraries for newer algorithms the first several years in use, there tend to be a high number of errors within the implementations creating vulnerabilities. To be clear, these are not vulnerabilities in the algorithms themselves, but in the source code. Post-Quantum Cryptography algorithms use mathematics that many programmers do not understand in depth, which makes finding these implementation errors and added vulnerabilities sometimes more difficult to identify and fix.
Hybrid vs. Pure – A Pure Post Quantum Cryptography implementation uses a single PQC algorithm. A hybrid scheme makes use of a classical algorithm, like ECDH, and a post-quantum algorithm, like ML-KEM. In a hybrid KEM scheme, the shared secrets are generated separately then combined using an approved KDF or key combiner to obtain the resulting key. For a hybrid signing scheme, both the classical and post quantum signatures must be verified separately. A hybrid implementation is thought to be the more conservative and safest in this interim time period before the realization of a Cryptographically Relevant Quantum Computer. That is because lattice-based algorithms, like ML-KEM and ML-DSA, are historically a newer type of algorithm to be used in cryptography, which means they have not gone through as much scrutiny from the general cryptography community. Should there be a break in lattice-based cryptography prior to the realization of a quantum computer then the security around the classical algorithm remains intact. While hybrid approaches add a layer of protection prior to the realization of a Cryptographically Relevant Quantum Computer, it also introduces a need for additional standards, or more complex standards to account for both hybrid and pure implementations. The complexity and options with hybrid schemes can lead to interoperability issues or even vulnerabilities if they are not implemented in a secure manner.
For an organization that hasn’t started this effort yet – what are your initial recommendations for designing a readiness strategy?
There are two options – handle your migration internally or outsource some or all of the tasks. For those who want to handle the efforts internally, it is all about getting to know your systems. There are resources that will help guide your process – some of the standardization organizations and government organizations have spent time creating these resources.
While cryptographic migration always takes resources, effort, and time (part of the reason I’m not fond of the term cryptographic agility), with a better understanding of the entire system, the hope is that the work to change algorithms decreases over time. For this specific migration, you should be aware of where your asymmetric keys are generated, stored, used, and transported. Once you determine which internal and external systems your keys interact with and which assets they protect, you can analyze risks and determine your migration order. Working with your vendors and taking their timelines into account will be important for planning purposes. The next step is determining which post-quantum algorithms and protocols best fit your needs.
How do security professionals and cryptography teams need to position the PQC-readiness needs and priorities to the C-Suite and Boardroom?
There are three main talking points when positioning any type of security change to the C-Suite and Boardroom: risk, timeline, and cost. I don’t think the strategy around PQC-readiness should be any different.
-
- The risks that a Cryptographically Relevant Quantum Computer present: stick to a simple explanation (how quickly RSA and ECC will be broken for example, and which critical systems rely on that cryptography).
- Compare the timeline of a Cryptographically Relevant Quantum Computer to the timeline to be fully protected.
- The cost should measure the impact of preparing vs not preparing. Showcase what is lost if they choose not to prepare and how long it will take to mitigate after.
Be prepared to answer questions about transition cost and timelines, impacted systems, and the impact on customers and employees. The migration and impact will look different for everyone, so come with direct knowledge of your own situation.
There are a lot of different opinions on how soon it will really be necessary to complete the migration to PQC, which brings us to our poll (no wrong answers here!) – when do you think we will see RSA2048 bit demonstrably broken by a quantum computer?
For more information on strong cryptography and key management best practices, see PCI SSC’s Cryptography Guidance document, available for download in the Document Library.
About Author
