Wolfgang Steinbauer, Head of Crypto & Security, NXP Semiconductors, explains how quantum computing has the potential to play a significant role in advancing our scientific knowledge and society in the coming decades, yet challenges the mechanisms we use today to secure information. This is why Charter of Trust Partners NXP, Infineon, and IBM are working on product solutions for a post-quantum future with long-term security.

By Wolfgang Steinbauer, Head of Crypto & Security, NXP Semiconductors

Security Threats Posed by Quantum Computing

Quantum computing will open up new fields of research and has the potential to play a significant role in advancing our scientific knowledge and society in the coming decades. However, its ability to instantly perform massive calculations also challenges the mechanisms we use today to secure information. Today, public-key and symmetrical key cryptography form the basics of encrypting and decrypting data and creating digital signatures. Very soon, at the rate that quantum computing is advancing, these security techniques are likely to be compromised.

Organisations involved in providing cryptographic services and semiconductor vendors, such as NXP and their Charter of Trust Partners Infineon and IBM, are keenly aware of the impact that quantum computing will have on the classic security techniques employed today. The industry is united to research and develop new cryptographic methods that are resistant to the capabilities that quantum computing provides. Termed post-quantum cryptography (PQC), it encompasses the study of new cryptographic algorithms and standards together with a migration path from existing cryptographic methods. Most importantly, PQC methods do not require a quantum computer to operate and utilise existing hardware platforms.

Quantum Supremacy Benchmarks

As in many fields of scientific research, the desire to stake claim to significant technology leaps has also shaped quantum computing innovations. Quantum supremacy is the term used to describe solving a complex equation with an early-stage quantum computer not possible using a conventional supercomputer. Quantum bits represent the basic element of information used in a quantum computer. One measure of the advancement in quantum computing is the computational power, measured in qubits. By the end of 2021, 100 qubit computers are already available for commercial research. However, industry opinion is that a 10,000 qubit system is required to compromise the widely used RSA-3072 public-key cryptographic algorithm. Nonetheless, the threat that quantum computing poses to established security algorithms in the coming decades is driving several critical PQC initiatives.

Post-Quantum Cryptography Essential to Futureproof Information Security

It might appear easy to overlook the extent to which we currently rely on public-key infrastructures such as RSA and ECC in our daily lives. Examples include using our smartphone for personal banking or investment transactions, the secure exchange of confidential medical records, and intelligent factory control systems. Other examples of potentially disruptive threats include circumvention of firmware upgrades in vehicles which might allow dangerous modifications to be installed to scenarios where one can retrospectively modify or forge digital signatures.

When it comes to developing a public-key infrastructure (PKI), the length of the key is an important metric. Long keys provide enhanced security but at the expense of the computational power required to compute with them. Although using long keys might not pose a challenge for a desktop computer, it does for a battery powered IIoT sensor. Consequentially, a key has a recommended length for a specific level of security. The USA’s National Institute of Standards and Technology (NIST) recommends PKI key length and the period of crypto protection. NIST and the German Federal Office for Information Security (BSI) play vital roles in fostering the innovation of new cryptographic standards for PQC. In 2016, NIST launched a competition inviting candidate algorithms suitable for PQC

The NIST PQC Competition

NXP as well as their Charter of Trust Partners IBM and Infineon are actively involved in the field of post-quantum cryptography and the standardization process. As part of this effort, NXP’s cryptographic experts have engaged with the NIST PQC standards process at an early stage. In 2020, NIST announced the finalist entrants in its PQC Competition, with two of the four key-exchange finalists co-authored by NXP security specialists.

With a long history of manufacturing semiconductor solutions used in security-based markets such as e-government, banking, and automotive, NXP is preparing to implement the new PQC standards once established. Already supplying semiconductor solutions based on current cryptographic PKI methods, NXP plans to offer customers a migration path for their products to the new standards. In addition to implementing the functional security techniques of PQC standards, NXP further believes more attention to logical and physical attack vectors are warranted.

During the NIST PQC process, the selection criteria included emphasis was the mathematical security and algorithm design. NXP security experts have delved deeper into the practical implementation aspects for each finalist candidate algorithm, with a particular focus on physical side-channel and fault attack vectors. A fault attack involves an adversary physically tampering with a device’s operation in an attempt to extract the secret key used. A side-channel attack covers a broad range of techniques based on analysis of how the device operates, including using information related to power consumption or electromagnetic radiation. NXP security consultants recently published a paper on their research and investigations of hardening the Kyber PQC algorithm; readers can access it here.

As the NIST PQC standard becomes ratified, work is already underway on their provisioning process. The first standardized post-quantum schemes are stateful hash-based signatures and involves a methodology process significantly different to those in use today. A transitional algorithm between current-day techniques and a quantum-resistance approach, the Commercial National Security Algorithm Suite (CNSA), uses traditional methods and larger key sizes. Many of NXP’s products already support CNSA.

Committed to a Post-Quantum Cryptographic Future

Quantum computing is emerging from innovation labs and being considered as a computing technology for some scientific research projects. However, it will be some time before the prospect of widespread deployment becomes a reality. Its contribution to society moving forward is hard to measure, but computer experts already predict it will be significant. That said, security specialists and information architects cannot underestimate the future threat it poses on our current widely used and standardized public-key infrastructure. Therefore, system designers will face many challenges transitioning their products to accommodate the new PQC standards.

Charter of Trust Partners have already made a significant contribution to the NIST PQC standards initiative and collaborated where such cooperation is permitted by compliance laws. NXP and Infineon co-submitted the NewHope scheme to the NIST standardization process (which made it to the second round) while NXP together with IBM co-submitted the Kyber algorithm for Quantum Safe Cryptography key-exchange, which is one of the finalist schemes.

It is now important that the industry works on products for a post-quantum future so customers can achieve long-term security in their products. Moving forward with the new standards will help ensure that the practical requirements of embedded security on resource-constrained devices, such as secure physical implementations, are fulfilled.

 

Image credit: rawpixel.com

You may also like

UK/EU Summit - “Risk to Resilience”
icon External Engagement

UK/EU Summit - “Risk to Resilience”

Detlef Houdeau, Senior Director, Business Development at Infineon Technologies was a speaker at the inaugural UK/EU Summit organized by our newest Associated Partners Shared Assessments.

💡Under the theme “Risk to Resilience” the first event of this series was held in London and brought together professionals from different industries and regions. Detlef participated in the panel about the complex regulatory landscape and emphasized that new legislation like the EU AI Act, DORA and Hashtag#NIS2 continue to push the standard of care on cybersecurity and other risks.

Thanks to Shared Assessments for organizing such an amazing event and inviting the Charter of Trust to participate in this high-class panel alongside Andrew Moyad, CEO at Shared Assessments.
October 08, 2024
36th Cyber Security Day: Working together for more resilience in the digital future
icon External Engagement

36th Cyber Security Day: Working together for more resilience in the digital future

Strong networks and effective cooperation are the key to successfully shaping the digital future in Germany. Cybersecurity is a team effort, and that was again visible last week at the 36th Cyber Security Day in Berlin.

🌐On 26 September 2024, the Bundesamt für Sicherheit in der Informationstechnik (BSI), Alliance for Cyber Security, and the DIHK invited experts, companies, authorities and political decision-makers to jointly strengthen Germany's cyber resilience.

The event was a great mix of policy debate, practical exchange, workshop and networking under the motto ‘Stronger Together: Greater Resilience through Cooperation’.

✨ One of the highlights of the day was the closing panel with Claudia Plattner, President of the BSI, Dr. Stefan Saatmann, Deputy Head Berlin Office at Siemens, Konstantin von Notz, Member of the Bundestag for B90/Greens, and Alexander von Gernler, German Informatics Society, interchanging ideas to foster resilience through collaboration. Initiatives like the CoT baseline requirements and its huge potential for international harmonizing cybersecurity regulations were discussed as well.

Let’s all work together so that closer cooperation between the BSI and businesses bring more tangible effects to increase digital resilience. Special thanks to Nils Hasenau for providing the excellent photos and also to Simon Ulmer and Ralf König for attending the event.
October 01, 2024
Nordic Cyber Summit 2024
icon External Engagement

Nordic Cyber Summit 2024

The Charter of Trust at the Nordic Cyber Summit
What a great opportunity for Morten Kromann, Head of Industrial Security Denmark at Siemens, to present the Charter of Trust perspective on cybersecurity regulations like Hashtag#NIS2 at the Nordic Cyber Summit in Copenhagen.

This year the summit was again a formidable event to engage with top cybersecurity experts, share insights, and discuss strategies to navigate the ever-evolving threat landscape in the Nordic region with the theme “Fortifying the Future: Building Cyber Resilience in a Transformed World”.

A main aspect highlighted by Morten was the discrepancies between the NIS2 directive’s incidents reporting timeframe and related provisions adopted in other legislations. These regulatory overlaps create difficult compliance environments for industry and costly operational pressures which add to the fragmentation of the market instead of harmonizing it. That is why the Charter of Trust emphasizes streamlining reporting requirements stemming from these different legislative frameworks and developing single entry points for reporting on the national level.

These and more points will also be discussed during our next Security-by-default Webinar taking place on the 29th of October. Sign up to find out more what the Charter of Trust Partners views are on how to prepare for NIS2 and other regulations: https://lnkd.in/eh_z8Z63
September 16, 2024