Solving The Quantum Threat With Post-Quantum Cryptography On eFPGAs

The quantum threat and post-quantum cryptography
Advances in quantum computing technology threaten the security of current cryptosystems. Asymmetric cryptography algorithms that are used by modern security protocols for key exchange and digital signatures rely on the complexity of certain mathematical problems. Currently, the main problems used for asymmetric cryptography are integer factorization of RSA and elliptic curve discrete logarithm of the elliptic curve cryptography (ECC). Shor’s algorithm is a quantum algorithm that can solve these problems if a large enough quantum computer is built. As a consequence, this would break the related cryptosystems and the basis of current computer and communication security. Although quantum computers of cryptographic significance do not exist today, many systems designed now will be in use for decades. It is also possible to record data today and break it in the future when powerful quantum computers will be available.

The international security community woke up to this quantum threat several years ago and developed ways to mitigate it. Post-quantum cryptography (PQC) are algorithms
that run on traditional computers but are based on mathematical problems that cannot be solved efficiently with Shor’s algorithm, or by any other known quantum computing algorithm. Unique solutions will be required to solve this complex problem and many people are researching it. In 2016, the National Institute of Standards and Technology (NIST) of the United States initiated a competition to find solutions to standardize PQC algorithms. After three rounds, the competition concluded in July 2022 with the publication of four winning algorithms that will be standardized: CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and SPHINCS+. Kyber is a so-called Key Encapsulation Mechanism (KEM) that is used for key exchange and the rest are digital signature algorithms. NIST continues the competition with a fourth round to find even further advanced PQC algorithms for a more robust standard in the future. Although the algorithms to be standardized are now known, they may still be tweaked before even the draft standards are written. The final standards are expected to be published in a couple of years and may still change from what is known today.

System designers need to start shifting to PQC immediately, as many organizations and formal requirements mandate security systems to support PQC in the near future. The recent announcement by the National Security Agency (NSA) mandates certain US national systems to support PQC in 2025. These requirements, combined with the still changing PQC landscape, set very high needs for crypto agility: the ability to update and change cryptographic algorithms in deployed systems. There are some solutions being proposed.

Click here to read more.