A medida que la hoja de ruta hacia la producción se aclara, el Director de PKI de Keyfactor detalla cuándo y cómo comenzar a implementar los nuevos estándares del NIST.
The National Institute of Standards and Technology (NIST) has initiated the standardization process for four algorithms that were specifically designed to be resilient against quantum computer attacks. These algorithms were selected by NIST last year and are now one step closer to being accessible to organizations worldwide for integration into their encryption infrastructure. NIST recently released draft standards for three of the four chosen algorithms, while the draft standard for the fourth algorithm, FALCON, is expected to be published in about a year. Other algorithms were considered during the multi-year selection process and failed the rigorous testing processes, and did not hold up to public scrutiny.
Once completed, the new standards will provide the world with the first tools to protect sensitive information from this new threat. While current encryption algorithms are yet to be surpassed by quantum computers, experts emphasize the need for proactive planning to ensure long-term security. This is particularly important as integrating new algorithms across all computer systems can be time-consuming and span several years.
Now that the official word is out, industry and government organizations will race against PQC advancement to implement these standards. The cryptographic community has until November 22, 2023, to make comments before NIST finalizes the standard documents.
Preguntas y respuestas con el Director de PKI de Keyfactor
Keyfactor’s Chief PKI Officer, Tomas Gustavsson, weighs in on the breaking industry news and advises organizations on when and how to start implementing NIST’s new standards.
¿Qué significa este anuncio del NIST para la comunidad criptográfica?
TG: The news from NIST means the race is on. Organizations and vendors will quickly work to implement strategies for PKI replacement and data encryption (at rest and in transit) and develop additional protocols. We expect to see a myriad of advice, white papers, use cases, mandates, and more.
The uncertainty surrounding which algorithms will be used in practice has nearly disappeared. It is an important step because it allows organizations to focus on these algorithms for testing until production. The roadmap to production is becoming clearer, as there are now timelines outlining when the final standards will be available. For product vendors, it provides a path for development and interoperability testing.
OIDs (object identifiers) will not be released until the final standards, so it is not yet time to go to production, but the path forward is (almost) clear. What is still unclear is that we don’t know when FIPS certification can be performed. We will likely learn more about that once standards are published, potentially in early 2024.
En cuanto a la solicitud de comentarios del NIST, ¿es necesario cambiar algo en los borradores de los estándares?
TG: There is still uncertainty around Prehash usage of the digital signature algorithms for signing large payloads like CRLs, documents, or software using network-connected or cloud HSMs. It is mentioned in the FIPS 204 draft section 7.1 and the FIPS 205 draft section 9.4, but not with many details.
¿Cómo se posiciona Keyfactor ante este cambio inminente?
TG: Keyfactor has been paving the way with testing implementation — over a year ago, Bouncy Castle was updated to support these algorithms. Keyfactor continues to be a leader in readiness and an advocate for organizations that need help with roadmapping, transitioning, and planning. Our custom PKI solutions enable organizations to prepare, no matter what step of the process they’re in.
Ser propietarios de la pila de Software completa, desde las bibliotecas criptográficas hasta el Software de PKI y firma digital y la gestión del ciclo de vida, nos permite ser de los primeros en soportar los nuevos estándares. Nuestro Software puede funcionar como un modelo para que otros realicen pruebas, y los clientes pueden sentirse seguros de que las soluciones de Keyfactor están preparadas para la era cuántica.
A grandes rasgos, ¿qué consejo puede ofrecer a las organizaciones que buscan implementar estos estándares (especialmente en lo que respecta a la PKI)?
TG: Now is the time for organizations to start taking inventory of systems for migration and identifying which are the most sensitive and most exposed. Security leaders also must look at the application ecosystem and start planning the migration— set up lab environments to test PQC PKI and prepare signature validation software for new algorithms. In short, start learning now so you can focus on the standardized algorithms and move forward. This change will come with a long learning curve for many organizations, so the time to begin the journey is today.
Mirando hacia el futuro: Obtenga más información y pruébelo hoy mismo
Keyfactor EJBCA and SignServer already support issuing quantum-ready PKI certificates alongside the existing PKI within the same environment. This ensures a smooth experience with minimal disruption to your current infrastructure and environments. You can begin experimenting with the technology and gradually understand its relevance to your specific environment over time.
Bouncy Castle cryptographic APIs support all the new algorithms and many others. The latest beta release has been updated with the algorithm changes that came with the draft standards.
EJBCA soporta los algoritmos ML-DSA (DILITHIUM) y NL-DSA (FALCON) para CA raíz, CA emisoras y entidades finales. Aunque se pueden generar Listas de Revocación de Certificados (CRL), ciertos aspectos, como el Protocolo de Estado de Certificado en Línea (OCSP) y otros protocolos, aún se encuentran en fase de desarrollo y estarán disponibles en el futuro. SignServer soporta ML-DSA (DILITHIUM) y SLH-DSA (SPHINCS+) para CMS y firma en bruto.
Check out our how-tos and videos, including:
- Configuración de una CA raíz ML-DSA y una CA emisora y emisión de su primer certificado de firma de código preparado para la era cuántica con EJBCA y luego firmar código con ML-DSA en SignServer
- Emisión de certificados híbridos preparados para la era cuántica utilizando el proyecto Kotlin de Bouncy Castle.
Suscríbase a The Source
Stay secure with Keyfactor's monthly newsletter, packed with expert insights and practical steps for quantum-readiness.
