Post Quantum Cryptography – The Impact on Identity
As PQC continues to be a major topic for many companies and Government Institutions, we take a dive into the topics of quantum computers, post-quantum-cryptography, and the potential relevance for (ID) use cases.
This seminar would like to present the principles of the technology and the latest developments in this field as well some indication as to the relevance, impact, and consequences on (Government) ID projects or use cases. The seminar may also look towards the relationship with these projects not only from a hardware standpoint but also from a software algorithmic stance as we migrate from current used crypto systems to quantum-proof systems.
KEY TAKEAWAYS
- What is a Quantum Computer, what is Post Quantum Cryptography and when will we see a quantum computer?
- The migration from current crypto systems to quantum proof systems.
- How will PQC and QC affect (Government) ID projects and implementations.
- What will QC mean for the security proofing of ID and Information in the future.
TARGET AUDIENCE
- Interested parties in the field of Identity and Security.
- Government bodies looking to the future for ID document management systems
- Enterprises looking to understand the potential impact of QC upon their business and industries.
Access the Recording | |
|---|---|
| English | access |
AGENDA
02:00 pm CEST Steve Atkins, Program Directors, Silicon Trust
START & Introduction
02:20 pm CEST Robert Bach
PRESENTATION: Protecting Electronic Identity Documents in the Age of Quantum Computing
Quantum computers use quantum mechanical effects for computation. They aim for breakthroughs in various areas such as artificial intelligence or chemical simulation, but they equally can be used to perform cryptanalysis. Once available with sufficient computing power, quantum computers can solve certain calculations much faster than today’s computers. They are disruptively threatening current security algorithms such as RSA (Rivest Shamir Adelman) and ECC (Elliptic Curve Cryptography), which are used in electronic Identity documents.
In 2017, the NIST (National Institute of Standards and Technology) has started a competition to select cryptographic algorithms withstanding the computing power of quantum computers, enabling the Post Quantum Cryptography (PQC). While the selection process of the first algorithm candidates is finished, work continues to integrate the Post-Quantum Cryptography in all relevant ID standards – and this will still take time. Nevertheless, the rapid progress in the development of quantum computers suggest to already start today preparing for a quantum era.
Robert Bach will summarize the key facts of post-quantum cryptography and describes the status of the work on quantum computers and standardization activities. The main part of the speech focusses on the consequences for ID documents and ID projects.
02:45 pm CEST Dr Carmen Kempka
PRESENTATION: Cryptoagility and Quantum Resistance: Easier Said Than Done.
Ever since the publication of Shor’s quantum algorithm for the factorization of large numbers, it has been known that quantum computers could at some point pose a threat to our communication and data security. Today we have cloud access to small, functioning quantum computers. The answer to this threat is quantum-resistant cryptography: cryptographic methods for classical computers that are robust against attacks by quantum computers.
The standardization of such methods is currently ongoing. However, these methods are based on mathematical problems, that are much younger than the factorization problem already investigated by Euclid. On the other hand, currently used cryptographic methods such as RSA or ECDSA are broken as soon as a sufficiently large quantum computer exists. Cryptoagility is therefore recommended, software should be built or modified in such a way that cryptographic algorithms are easily substitutable. But how great is the danger posed by quantum computers? To what extent is cryptography affected, and when do we need to take action? Is cryptoagility really so easy to implement in practice or is this perhaps much easier said than done?
03:10 pm CEST Lutz Richter
PRESENTATION: How will Post Quantum Cryptographic affect Contactless Travel in Entry-Exit Solution
The presentation will dive deeper into the current trends of entry-exit solutions towards contactless travel, taking into account the challenge of Post Quantum Cryptography (PQC). Which standards need to be considered and which system components need to be adapted to be PQC ready.
Post-quantum computer cryptography is a challenge when it comes to the verification of digital and mobile travel documents, because the data security is based on cryptographic security and implemented by a public key infrastructure. Currently, there is no known way for a classical computer to recompute the private key to break the commonly used public key algorithms. With a sufficiently powerful quantum computer, however, it will be possible and will dramatically change the conditions under which we can trust digital travel documents and mobile documents.
In a 100% digitalized entry-exit system, an integration of public key directory is a must in order to verify the authenticity and integrity of the presented digital and mobile travel documents. PKI is mandatory in future scenarios by using LDS 2.0 in eMRTD.
According to the PQC, the following system components must be replaced as such as, digital and mobile travel documents, personalization systems, PKI and verification systems, and algorithms for secure communication and data storage do no longer serve the standards.
03:35 pm CEST Klaus Schmeh
PRESENTATION: Implementing Post-Quantum-Crypto Algorithms on Smart-Card Chips
The progress in quantum-computing technology makes it necessary to migrate from the currently used asymmetric crypto systems, especially RSA, to quantum-proof algorithms within the next ten to fifteen years. This is also the case for smart cards and other integrated-chip platforms, as RSA is extensively used in these environments. The last two years saw considerable progress in the standardization of quantum-proof crypto systems, with CRYSTALS-Kyber (key exchange) and CRYSTALS-Dilithium (digital signatures) having become the major algorithms. Falcon, SPHINCS+ and a few others are considered important alternatives, while other promising methods are still evaluated.
Implementing post-quantum cryptography on smart cards and other resource-constrained platforms is challenging, as most of these crypto systems require longer keys and are less performant than the currently used methods. In addition, many current chips are optimized for RSA, which is useless for post-quantum algorithms, as they are based on different mathematical concepts. This talk explains the main post-quantum algorithms, especially CRYSTALS-Kyber and CRYSTALS-Dilithium, and evaluates their suitability for smart-card implementations. It will become clear that the current chip architectures will have to be adapted to the new methods.
The talk will be illustrated with cartoons and animations, requiring only a basic knowledge of mathematics.