NIST releases draft standards for 3 post-quantum encryption algorithms

The National Institute of Standards and Technology is taking another large step in its ongoing mission to steer organizations toward post-quantum cyber readiness, announcing the beginning of agency efforts to standardize the four quantum-resistant algorithms identified in 2022.

As the world allocates increased funding towards both the basic research and near-term applications of technologies that leverage quantum computing, one use case threatens current cryptographic schemes safeguarding classical computer networks.

The advent of a fault-tolerant quantum computer’s exponentially more powerful processing speeds threatens the traditional algorithms that are used to encrypt sensitive data today.

Ahead of this development, NIST is looking for feedback on its draft standards for three of the four algorithms currently approved by the agency as it looks to help entities across the world migrate their digital networks to quantum-resilient code. 

“We’re getting close to the light at the end of the tunnel, where people will have standards they can use in practice,” Dustin Moody, a NIST mathematician and project lead, said in a press release. “For the moment, we are requesting feedback on the drafts. Do we need to change anything, and have we missed anything?”

The deadline for feedback on NIST’s standardization efforts is November 22, 2023. 

NIST made the initial selection of four algorithms designated suitable for post-quantum cryptographic migration in July 2022, and each of the four — named CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+, and FALCON — are specialized for different applications. CRYSTALS-Kyber, for example, is designed for general secure website encryption, while the rest focus on securing digital signature software. 

A second set of algorithms was selected by NIST for further evaluation in order to augment the original four. Moody estimated one or two of these secondary algorithms will be chosen to supplement generalized encryption efforts. 

Of the four algorithms selected in 2022, CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+ have their individual draft Federal Information Processing Standard publications. Draft standards for FALCON are expected next year.

Sets of backup algorithms were chosen following an “unusual” break in the post-quantum tailored SIKE algorithm by a traditional computer. While strange, Moody added that the main surprise was the algorithm cracking late in the review process. 

“It was mainly an indication that our process is working as it should,” he said.

Greg Wetmore, VP of software development at Entrust, which specializes in network and data security, said that any organization with sensitive information stored digitally will be threatened by the advent of fault-tolerant quantum computing. 

“NIST’s release of draft standards provide the secure, open and interoperable cryptographic guidelines that will allow organizations to protect their data from the quantum threat,” Wetmore told Nextgov/FCW in a statement. “These NIST PQC standards are an important next step that will push all organizations, public and private, to move ahead with PQC preparations today, which will secure data and minimize the damage to the organization from a critical future threat.”