Two leading government agencies are getting set to release their latest guidance for Federal officials on how to start securing critical data against potential cybersecurity threats posed by advances in quantum computing, officials said on May 30.
The National Institute of Standards and Technology (NIST) will make public finalized standards for three quantum-resistant algorithms designed to help agencies move to more advanced quantum-resistant methods, said Bill Newhouse, a cybersecurity engineer at NIST’s National Cybersecurity Center of Excellence.
Draft standards for the algorithms were released last August, and after securing public input NIST will put out the final standards most likely in July, Newhouse said at ATARC’s Federal Quantum Summit 2024. “You will have three new Federal Information Processing Standards (FIPS) available to you,” he said.
At the Cybersecurity and Infrastructure Security Agency (CISA), officials are also working on a document to guide agencies in the move to post-quantum cryptography, said Ross Foard, a senior engineer at CISA.
Foard said the document, which is currently in the approval process and is expected to be released sometime this summer, will focus on helping agencies inventory – and prioritize – their current cryptographic algorithms to better protect systems going forward.
“This is a long-term transition,” he said at the summit. “So right now, the things that this is going to be helping with is really focusing on doing discovery and inventory.”
The document releases would represent the latest steps in a flurry of Federal activity aimed at updating U.S. IT infrastructure to protect against the cybersecurity threats posed by quantum computing.
Though most experts say a quantum computer large enough to pose a threat likely won’t be available for 10-20 years, officials have been warning that at some point quantum will be capable of breaking much of the cryptography that currently secures America’s digital communications on the Internet.
That could put at risk everything from national security secrets to medical records and personal emails if U.S. adversaries such as China can use quantum computing to decrypt that data.
The Biden administration kicked off the post-quantum push with a 2022 National Security Memorandum calling for the Federal government to leverage resources to help all U.S. digital systems migrate to quantum-resilient cybersecurity standards by 2035.
The Office of Management and Budget (OMB) released a memo in November 2022 to inform agencies of the forthcoming requirement to transition to quantum-resistant systems.
Last year, the White House’s Office of the National Cyber Director released specific guidance for government entities to submit to the administration prioritized inventories of cryptographic systems.
In August 2023, NIST released its draft standards for the three quantum-resistant algorithms. Even as the standards are being finalized, agencies are working to catalogue their inventories and set priorities for the transition, speakers at the forum said.
Daniel Corbin, deputy chief information officer and technical director for the U.S. Marine Corps, said the agency has “been working with this crypto problem now for some period of time … we have cryptographic algorithms that are no longer secure as they need to be.”
Corbin said the Marine Corps is “making fairly good progress” in understanding those current algorithms and, “in many cases, modernizing the cryptology.”
But speakers also emphasized the challenges of transitioning to the post-quantum world, which include everything from securing Federal funding to lighting a fire under employees to work on something that seems to be off in the distant future.
“When you hear the words post -quantum, how much does that make you want to jump up and do something today?” Newhouse acknowledged.
In the end, the transition will take time and patience, said Charlotte E. Hinkle, a senior physical scientist for the U.S. Government Accountability Office (GAO).
“The big thing to think about here is time … these are not things that happen overnight,” she said. “It’s something that is going to take time, and it’s going to take effort … The sooner we can get started on it, the better off we will all be.”