CISA, NSA and NIST Joint Factsheet - Quantum-Readiness: Migration to Post-Quantum Cryptography

What CISA, NSA and NIST Joint Factsheet - Quantum-Readiness: Migration to Post-Quantum Cryptography requires

Quantum-Readiness: Migration to Post-Quantum Cryptography is a joint factsheet created by the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the National Institute of Standards and Technology, marked TLP:CLEAR and dated as of August 17, 2023. It was created to inform organizations, especially those that support Critical Infrastructure, about the impacts of quantum capabilities, and to encourage early planning for migration to post-quantum cryptographic standards by developing a Quantum-Readiness Roadmap. It predates the final standards and states that NIST was working to publish the first set of post-quantum cryptographic standards, to be released in 2024; its algorithm references are therefore to draft standards and must be read as such. Its contribution is a discovery-and-procurement method rather than an algorithm position. The urgency argument is that early planning is necessary because cyber threat actors could be targeting data today that would still require protection in the future, or in other words has a long secrecy lifetime, using a catch now, break later or harvest now, decrypt later operation, and that many cryptographic products, protocols and services relying on public key algorithms such as RSA, Elliptic Curve Diffie-Hellman and the Elliptic Curve Digital Signature Algorithm will need to be updated, replaced or significantly altered. The method has four parts. Establish a quantum-readiness roadmap by first creating a project management team to plan and scope the migration, with that team initiating proactive cryptographic discovery activities and including cybersecurity and privacy risk managers who can prioritise the assets that would be most impacted. Prepare a cryptographic inventory using discovery tools across network protocols, assets on end user systems and servers including applications and associated libraries, and cryptographic code or dependencies in the continuous integration and continuous delivery development pipeline, correlating the result with existing programmes such as Asset Inventory, ICAM, IdAM, EDR and CDM, and feeding it into the risk assessment process. Discuss post-quantum roadmaps with technology vendors, with the factsheet noting that solidly built roadmaps should describe how vendors plan to migrate, charting timelines for testing algorithms and integration into products, and urging organizations to proactively plan for necessary changes to existing and future contracts so that new products are delivered with post-quantum cryptography built in and older products are upgraded to meet transition timelines. Address supply chain quantum-readiness, prioritising high impact systems, industrial control systems and systems with long-term confidentiality or secrecy needs, and treating migration as an IT and OT modernization effort. The factsheet explicitly warns that discovery tools may not be able to identify embedded cryptography used internally within products, and that organizations should ask vendors for lists of embedded cryptography within their products.

Pillar: Cybersecurity · Authority: Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA) and National Institute of Standards and Technology (NIST) · Version: 1.0.0 · Last updated: 2023-08-17

Primary source: https://www.cisa.gov/sites/default/files/2023-08/Quantum%20Readiness_Final_CLEAR_508c%20%283%29.pdf

SHA-256 integrity: 70ee09c3e5a07cc811ce956cfcca6f5b558ba82d80f2b0c83c117a830f361559

Primary Citations — 10 traced to source

+ 8 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/us-cisa-nsa-nist-quantum-readiness-factsheet.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/us-cisa-nsa-nist-quantum-readiness-factsheet.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/us-cisa-nsa-nist-quantum-readiness-factsheet
• Back to registry: Browse all 10,108 compliance nodes