Part 3
The Post Quantum Transition

By Janet Jones, M3AAWG Vice Chair Board of Directors / Data & Identity Protection Co-Chair (Microsoft)

Let’s take a closer look at what the Post-Quantum Transition looks like, why it is important to the industry and for the M3AAWG community, and how we can start to prepare for it.  

Post-Quantum Cryptography and Quantum Computing have been topics of discussion for many years and of late have been picking up momentum quickly with new breakthroughs in innovations. The Post-Quantum Transition keynote and panel sessions in Montreal were quite eye opening for members to hear about the upcoming impacts. The panelists, representatives from industry, academia, and government, stressed the importance of preparing now for the transition versus waiting until it is too late.

What did we learn about the Post-Quantum Transition?

New cryptographic algorithms have been developed and are currently under review under NIST’s Post-Quantum Standardization Project. This project launched Nov 30, 2017 and research teams from around the world responded to the challenge. NIST and the crypto community are now engaged in cryptanalysis for the newly developed algorithms and they are expected to announce results in the coming years. Industry migrations to new cryptographic algorithms takes time and must be carefully orchestrated to minimize ecosystem disruptions. Cryptographic algorithm migrations, like other technology migrations, go through phases and include parallel workstreams. 

The research and development phase started several years ago for Quantum Computing cryptographic algorithms, shortly followed by industry standards discussions, and most recently in the last couple of years we have started to see pilot and prototype implementations for some of the new algorithm candidates. We learned about the Open Quantum Safe project that is being led by the University of Waterloo and other industry and academic contributors to “support the development and prototyping of quantum-resistant cryptography” and it was noted they are actively looking for other contributors and potential implementer pilot/prototype scenarios. 

So, why is the Post Quantum-Transition an emerging threat and technology focus area and how is it relevant for the industry and the M3AAWG community? 

At the 35th General Meeting in Atlanta, M3AAWG recognized the authors of the “Keys Under Doormats: Mandating Insecurity by Requiring Government Access to All Data and Communications" paper and further endorsed the message of supporting the use of encryption. Previous M3AAWG Chairman of the Board, Michael Adkins, made a great comment about how this was important to the work M3AAWG is doing.

“Our organization exists to develop industry best practices to protect people from abuse and it would seem that encouraging encryption and limiting law enforcement's access to questionable files might actually make our job harder. But secure, trusted communications are necessary to support both people’s well-being and the global economy.  While law enforcement's intentions are well-placed, the Keys Under Doormats report clarifies the technical and public policy issues associated with exceptional access and how it would inadvertently create a complex surveillance ecosystem that would put the global online community at risk.” 

Encryption is essential to protect data and is used throughout the internet and supporting services. Future quantum computers are a threat today as data could be recorded now and exploited later with post quantum cryptography advances. 

How do we start to prepare for a Post-Quantum Transition?

First step would be to inventory and understand where, what, and why encryption is being used for existing platforms and services. Determine how to build in crypto-agility into existing systems where possible and make crypto-agility a must-have feature of new systems, taking into consideration hybrid solutions. Understand your existing data retention requirements and limit storing data where possible to minimize exposure to the record now and possible exploit later scenario. Seek areas to collaborate and contribute to industry, academic, and government planning efforts and pilots. 

For M3AAWG specifically, we will need to update or provide new best practice guidance to the Anti-Abuse community. Previous related best practices examples that will be need to be updated include TLS for Mail: M3AAWG Initial Recommendations, M3AAWG Initial Recommendations for Addressing a Potential Man-in-the-Middle Threat, M3AAWG Initial Recommendations for Using Forward Secrecy to Secure Data, and M3AAWG Describes Costs Associated with Using Crypto.