A few weeks ago, Infosec Global (ISG) participated in the ETSI Quantum-Safe workshop in Seattle, Washington. ISG had two accepted contributions at this workshop: (1) a presentation at the main technical track on hybrid key agreement integration to VPN and (2) a poster at the poster session.
We had a great time and learned a lot at this event. The workshop was an excellent place to see where the trends go in quantum-safe cryptography and to position ISG as leading in the field.
Here are our top 5 insights from the ETSI workshop:
The Need For PQ Hybrid Key Exchange
1. PQ hybrid key exchange is the first step that needs to be taken now if one wants to guarantee data confidentiality for more than 10 years. How does one otherwise want to guarantee e.g. 100 years confidentiality for health-related data?
SIKE Is Well-Suited For VPN/IKEv2 Integration
2. Cloudflare and Amazon presented their integration of hybrid key exchange to the TLS protocol. ISG’s hybrid key exchange work followed the same idea with an integration VPN/IKEv2, and it has a few differences compared to TLS. While the TLS experiments have shown minimal impacts of larger key sizes, the keys in IKEv2 should optimally be restricted to 1500 bytes (the typical path MTU due the size of Ethernet frames). Our NIST submission SIKE is especially well-suited for this case because of its short key sizes. It’s even possible to combine SIKE with a lattice-based scheme like Kyber while maintaining the size limit.
German BSI to Approve Two PQ Candidates
3. NIST confirmed and described how hybrid key exchange can be used while retaining FIPS approval.The German BSI announced their intention to approve two PQ candidates for official use in hybrid mode next year. Their selection will most likely be FrodoKEM (unstructured lattices) and McEliece (code-based) as two relatively conservative approaches.
Chinese PQ Competition Closely Follows NIST
4. The Chinese government runs a PQ competition independent from NIST, mainly with Chinese submissions. Many proposals correspond to the NIST categories, and some have similar names. For example, there is an isogeny-based scheme named “SIAKE.”
Taking Cryptographic Inventory Is Step One
5. Getting a cryptographic inventory is seen as the first part in migrating to PQ crypto.This was mentioned by Bob Blakley from Citi and Jaya Baloo from KPN during their keynotes. Cryptographic agility is further a topic that is highlighted consistently when it comes to PQ migration.
The workshop was organized by ETSI and so a major focus was on standardization in different bodies like ETSI, NIST, IETF and ITU. Our time at ETSI served as great motivation for our work on PQ in AgileSec as well as with integrating cryptographic agility in the real world! Contact us at info@infosecglobal.com if you’d like to find out more insights from the ETSI Quantum-Safe Workshop, or if you’d like to learn more about our solutions.
