NIST Mandates Phased Post-Quantum Cryptography Migration by 2035
NIST has detailed a phased approach for agencies to migrate to post-quantum cryptography, allowing hybrid solutions and setting a 2035 deadline for phasing out quantum-vulnerable public-key algorithms.
The National Institute of Standards and Technology (NIST) has outlined a comprehensive, phased strategy for federal agencies to transition to post-quantum cryptography (PQC), permitting the temporary use of hybrid algorithms that combine classical and quantum-resistant methods. This directive aims to address the growing threat posed by "harvest now, decrypt later" attacks and the eventual capability of quantum computers to break current encryption standards.
NIST's guidelines provide a technical framework for migrating federal high-value assets and high-impact systems, serving as a blueprint for critical infrastructure operators as well. This initiative aligns with the Office of Management and Budget's June directive for agencies to mitigate quantum risk by the end of 2030. The agency acknowledges that both quantum-vulnerable and quantum-resistant algorithms will coexist during the transition to ensure interoperability.
The migration plan prioritizes specific use cases for quantum-resistant protection, including code signing in software development, asymmetric key user sign-in, data transmission over public networks via TLS or VPNs, and email and document signing and encryption. However, NIST suggests that user-machine authentication, which is not susceptible to future decryption, can afford to wait until cryptographically relevant quantum computers become available. Conversely, encryption for data in transit requires immediate attention.
NIST has identified four families of post-quantum digital signature algorithms for identity, integrity, and source authentication, with two designated for general use and two for specialized applications like software and firmware signing. For key exchange, the agency has approved a primary quantum-resistant algorithm family based on Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), with an alternative selection undergoing formal approval.
While NIST mandates a 2035 deadline for phasing out quantum-vulnerable digital signature algorithms and unsafe cryptography, it will allow the continued use of risky algorithms in a "deprecated" state. This approach requires data owners to assess their own risks and make informed decisions about transitioning their organizations. The agency anticipates that organizations will likely operate on hybrid protocols for the initial years of the migration.
Hybrid solutions, which involve using existing and quantum-safe algorithms together or combining multiple PQC options, are seen as a crucial interim measure. These hybrid approaches can safeguard systems against potential flaws in individual algorithms, ensuring security as long as at least one component remains robust. They also offer a pathway for sectors reliant on legacy algorithms to accommodate PQC.
However, NIST cautions that hybrid solutions introduce complexity into implementations and architectures, potentially increasing security risks and costs during the transition. These hybrid measures are generally expected to be temporary, paving the way for a subsequent transition to systems that exclusively utilize PQC algorithms.
The timeline for this transition is notably tight, with historical precedents showing that the integration of standardized algorithms into information systems can take one to two decades. The deadlines set for transitioning key establishment and digital signatures leave little room for delay, underscoring the urgency for agencies to begin their migration planning and execution.