This week marks a pivotal moment in cybersecurity with the release by the National Institute of Standards and Technology (NIST) of three Post-Quantum Cryptography (PQC) encryption algorithms. This announcement underscores the urgent need for enterprises to take stock of their cryptographic assets and prepare for the quantum era.

Why This Matters

Quantum computers, while not yet fully realized, pose an existential threat to many of our current encryption methods. Once operational, these machines will have the compute power to break widely-used cryptographic algorithms like RSA and ECC in a matter of hours or days.

NIST Approved Algorithms

On August 13^th NIST published its highly anticipated first three selections for Post-Quantum Cryptography and is urging computer system administrators to begin transitioning to the newly finalized Federal Information Processing Standards (FIPS) as soon as possible. The three finalized standards include: FIPS 203, FIPS 204, and FIPS 205.

FIPS 203, ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
Intended as the primary standard for general encryption, features advantages such as small encryption keys that can be easily exchanged between parties and fast operation. This standard is based on the CRYSTALS-Kyber algorithm, now renamed.

FIPS 204, ML-DSA (Module-Lattice-Based Digital Signature Algorithm)
Designed to protect digital signatures, utilizes the CRYSTALS-Dilithium algorithm, renamed.

FIPS 205, SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)
Also focused on digital signatures, employs the Sphincs+ algorithm, renamed. This standard is based on a different mathematical approach than ML-DSA and serves as a backup in case ML-DSA is found to be vulnerable.

Additionally, when the draft FIPS 206 standard is released, it will be built around the FALCON algorithm, which will be renamed FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm).

The Urgent Call to Action

This release isn’t just a technical milestone, rather, it is a wake-up call for every enterprise.

Here’s why you need to act now:

• Crypto-Agility is key: The ability to swiftly transition between cryptographic algorithms will be crucial.
• “Harvest now, decrypt later” threats: Adversaries are already collecting encrypted data, waiting for quantum computers to crack it.
• Regulatory compliance: New standards are emerging that will require PQC readiness.
• Complex integration: Implementing PQC across an enterprise is a significant undertaking that requires careful planning.

Next Steps: Crypto Discovery

The first critical step is to conduct a comprehensive cryptographic discovery across your enterprise. This involves:

• Identifying all systems using cryptography
• Cataloging the types of algorithms in use
• Assessing the sensitivity and longevity of protected data
• Prioritizing systems for upgrade based on risk

Without this crucial discovery phase, organizations risk overlooking vulnerable systems or misallocating resources in their quantum preparedness efforts.

The release of these PQC algorithms is a landmark event, signaling that the post-quantum future is no longer a distant concern but an imminent reality. Enterprises that start their crypto discovery and transition planning today will be best positioned to face the challenges and opportunities of the quantum age.

FIPS & The New PQC Algorithms

NIST’s assignment of FIPS status to these new PQC algorithms is a significant development. FIPS are standards and guidelines for federal computer systems, developed by NIST under the Information Technology Management Reform Act of 1996.

Ramifications:

1. Federal Adoption: FIPS status mandates that all federal government systems must implement these algorithms. This includes both civilian and military agencies.
2. Industry Standard: FIPS often becomes a de facto industry standard, even for non-governmental organizations, due to its rigorous vetting process.
3. Global Influence: Many international standards bodies and foreign governments look to NIST FIPS for guidance, potentially leading to worldwide adoption.
4. Vendor Implementation: Major technology vendors will prioritize implementing these algorithms in their products to maintain federal contracts and meet market demands.

Impact on Compliance:

1. Mandatory Implementation: Federal agencies and contractors will be required to implement these PQC algorithms within a specified timeframe.
2. Certification Programs: Expect updates to certification programs like FIPS 140-3 for cryptographic modules to include these new algorithms.
3. Regulatory Updates: Regulations that reference NIST standards (e.g., HIPAA, FISMA) will likely be updated to require PQC implementation.
4. Audit Requirements: Compliance audits will begin to include checks for PQC readiness and implementation.
5. Procurement Policies: Government procurement policies will be updated to require PQC-capable systems and software.

Organizations Most Reliant on FIPS Standards:

1. Federal Government Agencies: All U.S. federal agencies are required to comply with FIPS.
2. Defense Contractors: Companies working with the Department of Defense and other security agencies must adhere to FIPS.
3. Healthcare Organizations: Due to HIPAA requirements, which often reference NIST standards.
4. Financial Institutions: Many financial regulations incorporate FIPS by reference.
5. State and Local Governments: Often follow federal standards as best practices.
6. Critical Infrastructure: Sectors like energy, water, and transportation often adhere to FIPS for cybersecurity.
7. Cloud Service Providers: Especially those serving government clients (e.g., FedRAMP-certified providers).
8. Telecommunications Companies: Particularly those handling government communications.
9. International Organizations: Many foreign governments and international bodies adopt FIPS standards.
10. Software and Hardware Vendors: Especially those selling to the U.S. government or regulated industries.

Discovery & Inspection Shift

The assignment of FIPS status to these PQC algorithms signifies a major shift in cryptographic standards. Organizations in these sectors will need to start planning for the transition to post-quantum cryptography to ensure continued compliance and security. This will involve not only implementing new algorithms but also reassessing overall cryptographic policies, updating key management practices, and potentially redesigning some systems to accommodate the new cryptographic requirements.

A comprehensive discovery and ongoing inspection of cryptography in an enterprise is crucial for multiple reasons:

1. Security Posture Assessment:
      – Identifies vulnerabilities in current cryptographic implementations
      – Reveals outdated or weak algorithms still in use
      – Highlights areas of non-compliance with industry standards

2. Risk Management:
      – Allows prioritization of systems for upgrade based on criticality and vulnerability
      – Enables informed decision-making about resource allocation for security improvements
      – Helps in creating a roadmap for cryptographic modernization

3. Compliance:
      – Ensures adherence to regulatory requirements (e.g., GDPR, HIPAA, PCI DSS)
      – Prepares the organization for audits and certifications
      – Facilitates reporting to stakeholders and regulatory bodies

4. Crypto-Agility:
      – Enables quick response to new threats or vulnerabilities
      – Facilitates smoother transitions to new algorithms (like PQC)
      – Reduces the risk of “cryptographic debt” accumulating over time

5. Data Protection:
      – Ensures sensitive data is properly protected throughout its lifecycle
      – Prevents data breaches due to cryptographic failures
      – Maintains trust with customers and partners

6. Operational Efficiency:
      – Streamlines cryptographic operations across the enterprise
      – Identifies redundancies or inconsistencies in cryptographic usage
      – Optimizes resource usage for cryptographic processes

7. Future-Proofing:
      – Prepares the organization for emerging threats (e.g., quantum computing)
      – Aligns cryptographic strategy with long-term business goals
      – Facilitates adoption of new technologies and standards

8. Incident Response:
      – Improves ability to respond to cryptographic failures or breaches
      – Enables quick assessment of impact in case of algorithm compromises
      – Facilitates targeted remediation efforts

9. Supply Chain Security:
      – Identifies cryptographic dependencies in third-party systems and software
      – Ensures vendors meet required cryptographic standards
      – Mitigates risks from supply chain attacks

10. Cost Management:
        – Prevents unnecessary spending on redundant or obsolete cryptographic solutions
        – Enables strategic investments in cryptographic infrastructure
        – Reduces potential costs from cryptographic failures or non-compliance

Ongoing inspection is particularly important because:

1. Threat Landscape Evolution: New vulnerabilities and attack vectors emerge constantly
2. Regulatory Changes: Compliance requirements evolve over time
3. Organizational Changes: Mergers, acquisitions, and internal restructuring can introduce new cryptographic challenges
4. Technology Updates: New systems and software may introduce different cryptographic methods
5. Algorithm Deprecation: Older algorithms become obsolete and need replacement

A robust cryptographic discovery and inspection process typically involves:

1. Automated scanning tools to identify cryptographic usage across the network
2. Manual review of critical systems and custom applications
3. Regular cryptographic policy reviews and updates
4. Continuous monitoring for new threats and vulnerabilities
5. Integration with change management processes to catch new implementations
6. Periodic third-party audits for an external perspective

By maintaining a comprehensive and up-to-date view of cryptographic usage, organizations can ensure they remain secure, compliant, and prepared for future challenges in the rapidly evolving landscape of information security.

 

Cryptographic Discovery & Inventory, Continuous Monitoring, and Remediation does not need to be hard or expensive. Learn more.