Microsoft Is Adding New Cryptography Algorithms
Microsoft is updating SymCrypt, its core cryptographic library, with new quantum-secure algorithms. Microsoft’s details are here. From a news article:
The first new algorithm Microsoft added to SymCrypt is called ML-KEM. Previously known as CRYSTALS-Kyber, ML-KEM is one of three post-quantum standards formalized last month by the National Institute of Standards and Technology (NIST). The KEM in the new name is short for key encapsulation. KEMs can be used by two parties to negotiate a shared secret over a public channel. Shared secrets generated by a KEM can then be used with symmetric-key cryptographic operations, which aren’t vulnerable to Shor’s algorithm when the keys are of a sufficient size.
The ML in the ML-KEM name refers to Module Learning with Errors, a problem that can’t be cracked with Shor’s algorithm. As explained here, this problem is based on a “core computational assumption of lattice-based cryptography which offers an interesting trade-off between guaranteed security and concrete efficiency.”
ML-KEM, which is formally known as FIPS 203, specifies three parameter sets of varying security strength denoted as ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The stronger the parameter, the more computational resources are required.
The other algorithm added to SymCrypt is the NIST-recommended XMSS. Short for eXtended Merkle Signature Scheme, it’s based on “stateful hash-based signature schemes.” These algorithms are useful in very specific contexts such as firmware signing, but are not suitable for more general uses.
Subscribe to comments on this entry
Clive Robinson • September 13, 2024 3:32 PM
@ ALL,
The PQC “Key Encapsulation Mechanism s”(KEMs) are still a “work in progress” as far as NIST is concerned with the standard specifying only “Module-Latice Based Key-Encapsulation-Mechanism”(ML-KEM) so far.
But importantly it is not exactly efficient for anything other than large or long messages. That is sending the average EMail is going to feel the strain. As for SMS style text messages…
As Microsoft Principal Product Manager Lead Aabha Thipsay notes,
Have a think on that, as Aabha goes on,
” Therefore, implementing PQC in real-world applications requires careful optimization and integration with existing systems and standards.”
What is not said is that the PQC algorithms involve considerable complexity and are “not real life tested” in a hostile environment like the Internet…
Ask yourself “What could go wrong?”
Well think back we had this problem with AES…
That is AES was theoretically secure, but practically… No not really the “up on the contest site” algorithms were quickly proven to be very insecure in practical implementations due to side channel issues that had not been considered during the competition (even now there are AES implementations “in use” that leak worse than Henry’s bucket, that he asked Lisa to help make good).
The fact is, the security of these PQC algorithms is still “untested theoretical” at best and nowhere near close to “battle proven”.
But what we do know is the PQC algorithms are at best “inefficient” which is never a good sign. Which is why quite a few are looking at the fairly rapidly improving “Quantum Crypto” and the likes of satellites for “Quantum Key Distribution”(QKD).
This Microsoft implementation is going to be an,
“All the eggs in one basket”
Solution which also makes it a “Single Point of Failure” or “attack” or “backdoor”…
It’s also why some have been saying “Hybrid Systems” should be the way to go, but… What has been suggested is not what others think should be the way to go.
To say things are a mess right now is a bit of an understatment.
From my perspective, I’m going to assume that PQC is “probably insecure” and look at other ways to get good “privacy” for where it might be needed.
Where “privacy” is not really required like most “On-Line” activities I’d be less worried about someone actually making a Quantum Computer that a “cods-up” in the implementation of PQC in practice.
Some will agree with me others will not, but from a certain “business perspective” the risks attached to PQC is currently to high. Especially when compared to other methods based around existing symmetric crypto and traditional (ie non asymmetric) KeyMat distribution systems.