NIST Role and Activities Relative to the Post Quantum Cryptography White House Memo

Action from Memorandum:

Section 3. Mitigating the Risks to Encryption.

Section 3 (a) Any digital system that uses existing public standards for public‑key cryptography, or that is planning to transition to such cryptography, could be vulnerable to an attack by a CRQC. To mitigate this risk, the United States must prioritize the timely and equitable transition of cryptographic systems to quantum-resistant cryptography, with the goal of mitigating as much of the quantum risk as is feasible by 2035.

Q: What does that mean? 

A: Transition your most important items to encrypt (and remember that the most important information you need to encrypt should be replaced no later than 2035)! This is still far away—but it’s important to start planning, prioritizing, and budgeting now.

Action from Memorandum:

Section 3 (c)(ix) Until the release of the first set of NIST standards for quantum-resistant cryptography referenced in subsection 3(a) of this memorandum, the heads of FCEB Agencies shall not procure any commercial quantum-resistant cryptographic solutions for use in IT systems supporting enterprise and mission operations.

Q:  What does that mean?

A:  Commercial products will be available soon but, without the final standards, do not procure PQC replacement technologies as they will be high risk for lack of interoperability, scale and extensive public analysis.

Action from Memorandum:

Section 3 (c)(i): Within 90 days of the date of this memorandum, the Secretary of Commerce, through the Director of NIST, shall initiate an open working group with industry, including critical infrastructure owners and operators, and other stakeholders, as determined by the Director of NIST, to further advance adoption of quantum-resistant cryptography. This working group shall identify needed tools and data sets, and other considerations to inform the development by NIST of guidance and best practices to assist with quantum‑resistant cryptography planning and prioritization. Findings of this working group shall be provided, on an ongoing basis, to the Director of the Office of Management and Budget (OMB), the Assistant to the President for National Security Affairs (APNSA), and the National Cyber Director to incorporate into planning efforts. 

NIST’s related roles and activities:

NIST is currently working to further advance the adoption of quantum-resistant cryptography via several projects.

A Post Quantum Cryptography Forum has been established to discuss the standardization and adoption of secure, interoperable, and efficient post-quantum algorithms. A Community of Interest at the NCCoE has also been established so innovators can share insights, technical expertise, challenges, and perspectives to guide NIST’s post quantum cryptography projects.

Action from Memorandum:

Section 3 (c)(ii): Within 90 days of the date of this memorandum, the Secretary of Commerce, through the Director of NIST, shall establish a “Migration to Post-Quantum Cryptography Project” at the National Cybersecurity Center of Excellence to work with the private sector to address cybersecurity challenges posed by the transition to quantum-resistant cryptography. This project shall develop programs for discovery and remediation of any system that does not use quantum-resistant cryptography or that remains dependent on vulnerable systems.

NIST’s related roles and activities:

NIST is currently working on a Migration to Post-Quantum Cryptography project at our National Cybersecurity Center of Excellence (NCCoE). Project goals include: demonstrating discovery tools that can provide automated assistance in identifying where and how public-key cryptography is being used, demonstrating the use of automated discovery tools to identify all instances of public-key algorithm use, identifying the algorithm employed and its purpose, and providing systematic approaches for migrating from vulnerable algorithms to quantum-resistant algorithms.

Action from Memorandum:

Section 3 (c)(viii): Within 90 days of the release of the first set of NIST standards for quantum-resistant cryptography referenced in subsection 3(a) of this memorandum, and on an annual basis thereafter, as needed, the Secretary of Commerce, through the Director of NIST, shall release a proposed timeline for the deprecation of quantum-vulnerable cryptography in standards, with the goal of moving the maximum number of systems off quantum-vulnerable cryptography within a decade of the publication of the initial set of standards. The Director of NIST shall  work with the appropriate technical standards bodies to encourage interoperability of commercial cryptographic approaches.

NIST’s related roles and activities:

NIST is currently focused on the first step: completing the first set of NIST standards. Once issued, NIST will publish an engagement plan to solicit feedback and work with the public on establishing deprecation of quantum vulnerable cryptography. NIST will NOT be publishing a deprecation date at that time.

Once inventories and budget assessments are complete, industry and critical infrastructure impacts are better known, and as we continue to monitor progress in quantum computing, NIST will establish a deprecation timeline*. 
 

*Note: We still all are working towards the transition goal of 2035—no matter the deprecation deadlines.