| NIST post-quantum cryptography | |
|---|---|
| Name | NIST post-quantum cryptography |
| Established | 2016 |
| Field | Cryptography; Quantum information science |
| Institution | National Institute of Standards and Technology |
NIST post-quantum cryptography
NIST post-quantum cryptography is the United States National Institute of Standards and Technology's program to evaluate, standardize, and recommend public-key cryptographic algorithms that are resistant to known attacks by quantum computers. The effort addresses the impending threat from quantum computing developments such as quantum algorithms like Shor's algorithm and Grover's algorithm, and matters to Quantum Physics because quantum information theory and experimental quantum platforms directly motivate adversary capabilities and attack models.
The program responds to advances in quantum computing research at institutions such as IBM, Google, Rigetti Computing, D-Wave Systems, and national laboratories including Sandia National Laboratories and Los Alamos National Laboratory. Quantum algorithms developed from theoretical work by researchers like Peter Shor and Lov Grover exploit properties of quantum bits (qubits) and quantum entanglement to solve problems substantially faster than classical methods. This threatens classical public-key systems built on integer factorization (RSA) and discrete logarithms (ECC) used in widespread protocols like Transport Layer Security (TLS). NIST's effort therefore bridges quantum information science and practical cybersecurity to preserve confidentiality, integrity, and authentication as quantum hardware progresses.
The initiative formally began in 2016 with a public call for proposals and a multi-year competition modeled in part after the earlier NIST Advanced Encryption Standard process. The timeline included rounds of evaluation, public comment, and cryptanalysis workshops co-hosted with academic centers such as Massachusetts Institute of Technology, University of Waterloo, California Institute of Technology, and industry partners. Core goals are to select algorithms for standardization that balance security against quantum-capable adversaries, performance on constrained devices, and practical implementability in systems managed by vendors like Microsoft and Google. The program also aims to stimulate research across cryptanalysis, side-channel resistance, and post-deployment migration planning.
NIST's multi-round selection process assessed dozens of submissions from global teams. The selection incorporated public cryptanalysis at conferences including CRYPTO, EUROCRYPT, ASIACRYPT, and workshops such as the NIST PQC Standardization meetings. In the later rounds, NIST announced finalists and alternate candidates and moved to specify algorithm parameters and API recommendations for standards. Notable algorithms that reached final consideration include schemes from the families represented by teams at Duke University, Technische Universität Darmstadt, and companies such as PQShield. The process emphasized open review, with specification documents and reference implementations scrutinized by communities centered around repositories on platforms like GitHub.
The candidate algorithms span multiple mathematical approaches intended to resist quantum attacks: lattice-based cryptography (e.g., schemes based on the Learning with Errors problem), code-based cryptography (built on problems such as McEliece cryptosystem variants), multivariate quadratic equations over finite fields, hash-based cryptography (e.g., XMSS and related signature schemes), and isogeny-based cryptography using elliptic curve isogenies. These foundations connect to mathematics and theoretical computer science research at institutions like University of California, Berkeley, ETH Zurich, and Princeton University, and to post-quantum cryptanalysis efforts led by teams worldwide.
Security evaluation considers classical cryptanalysis and quantum-capable adversaries able to run algorithms like Shor's algorithm or quantum-accelerated search via Grover's algorithm. Threat models include "harvest-now, decrypt-later" attacks where adversaries store encrypted communications today to decrypt when quantum resources mature. NIST coordinated with cryptanalysts from universities, industry labs, and standards bodies such as the Internet Engineering Task Force (IETF) and International Organization for Standardization (ISO) to evaluate resistance to both algorithmic attacks and implementation-level issues like side-channel attacks and fault injection. Security margins are established with reference to complexity assumptions, reductions to hard problems, and conservative parameter choices.
Practical deployment raises implementation concerns: key and ciphertext sizes, computational cost on constrained hardware (e.g., Internet of Things devices), and integration into protocols such as TLS, SSH, IPsec, and X.509 certificate infrastructure. Interoperability requires standard APIs and reference code, often implemented in languages like C and Rust. Implementers must also address side-channel mitigation, constant-time practices, and test vectors. Migration planning involves coordination among vendors, certificate authorities like Let's Encrypt, and government agencies to phase algorithms into existing ecosystems without disrupting services.
NIST's standardization influences global policy, procurement, and research priorities, informing guidance from agencies such as the U.S. Department of Homeland Security and international partners in the European Commission. Standardized post-quantum algorithms will affect product roadmaps at companies including Cisco Systems, Apple Inc., and Amazon Web Services. The program has catalyzed further research into hybrid cryptographic approaches, crypto-agility strategies, and quantum-safe hardware. It has also spawned academic work on the quantum hardness of problems and inspired collaborations among quantum information theorists, applied cryptographers, and systems engineers to ensure long-term data security in a post-quantum era.