NIST Releases First Post-Quantum Encryption Algorithms
From the Federal Register:
After three rounds of evaluation and analysis, NIST selected four algorithms it will standardize as a result of the PQC Standardization Process. The public-key encapsulation mechanism selected was CRYSTALS-KYBER, along with three digital signature schemes: CRYSTALS-Dilithium, FALCON, and SPHINCS+.
These algorithms are part of three NIST standards that have been finalized:
- FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
- FIPS 204: Module-Lattice-Based Digital Signature Standard
- FIPS 205: Stateless Hash-Based Digital Signature Standard
NIST press release. My recent writings on post-quantum cryptographic standards.
EDITED TO ADD: Good article:
One – ML-KEM [PDF] (based on CRYSTALS-Kyber) – is intended for general encryption, which protects data as it moves across public networks. The other two –- ML-DSA [PDF] (originally known as CRYSTALS-Dilithium) and SLH-DSA [PDF] (initially submitted as Sphincs+)—secure digital signatures, which are used to authenticate online identity.
A fourth algorithm – FN-DSA [PDF] (originally called FALCON) – is slated for finalization later this year and is also designed for digital signatures.
NIST continued to evaluate two other sets of algorithms that could potentially serve as backup standards in the future.
One of the sets includes three algorithms designed for general encryption – but the technology is based on a different type of math problem than the ML-KEM general-purpose algorithm in today’s finalized standards.
NIST plans to select one or two of these algorithms by the end of 2024.
IEEE Spectrum article.
Slashdot thread.
Subscribe to comments on this entry
Clive Robinson • August 15, 2024 12:34 PM
@ ALL,
I kind of guess based on the track record, one the first questions in peoples heads will be,
“How long before a break gets anounced? Especially a non quantum break?”
Which is why other questions will get asked over the next few days and months, including “What Next?”
Mind you this from the press release gave me a hollow laugh,
With “collect it all” that “threat” started years ago for the majority, and like a “beheading” all we are waiting for “is the axe to fall”.
I guess the majority of records for the likes of “e-commerce” won’t be of interest unless for things that lets just say are “morally questionable” or worse, or can be used to show “behaviour patterns”.
I don’t do e-commerce, and have not tried it since Amazon “behaved like a criminal” and I don’t do “social media” either and in general I keep my behaviours “uninteresting” and have done since before the 1990’s
Because I’m old enough to have lived through the failing of DES and Crypto-Wars-1 and foreseen the path that was being set for the majority to the “Guilded Cage” and took care to keep off of it, and still continue to do so.