Status report on the third round of the NIST Post-Quantum Cryptography Standardization process

Abstract

The National Institute of Standards and Technology is in the process of selecting public-key cryptographic algorithms through a public, competition-like process. The new public-key cryptography standards will specify additional digital signature, public-key encryption, and key-establishment algorithms to augment Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), as well as NIST Special Publication (SP) 800-56A Revision 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, and SP 800-56B Revision 2, Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography. It is intended that these algorithms will be capable of protecting sensitive information well into the foreseeable future, including after the advent of quantum computers. The first round of the NIST Post-Quantum Cryptography Standardization Process began in December 2017 with 69 candidate algorithms that met both the minimum acceptance criteria and submission requirements. The first round lasted until January 2019, during which candidate algorithms were evaluated based on their security, performance, and other characteristics. NIST selected 26 algorithms to advance to the second round for more analysis. The second round continued until July 2020, after which seven 'finalist' and eight 'alternate' candidate algorithms were selected to move into the third round. This report describes the evaluation and selection process, based on public feedback and internal review, of the third-round candidates. The report summarizes each of the 15 third-round candidate algorithms and identifies those selected for standardization, as well as those that will continue to be evaluated in a fourth round of analysis. The public-key encryption and key-establishment algorithm that will be standardized is CRYSTALS-Kyber. The digital signatures that will be standardized are CRYSTALS-Dilithium, Falcon, and SPHINCS+. While there are multiple signature algorithms selected, NIST recommends CRYSTALS-Dilithium as the primary algorithm to be implemented. In addition, four of the alternate key-establishment candidate algorithms will advance to a fourth round of evaluation: BIKE, Classic McEliece, HQC, and SIKE. These candidates are still being considered for future standardization. NIST will also issue a new Call for Proposals for public-key digital signature algorithms to augment and diversify its signature portfolio.

Post-Quantum Cryptography

“…After the 3rd round of evaluation, the public-key encapsulation mechanism (KEM) that will be proposed to standardize is CRYSTALS-KYBER. Regarding he digital signatures that will be proposed are CRYSTALS-Dilithium, FALCON, and SPHINCS+ [11].…”

“…Regarding security, although, many of the results remain speculative but are in line with the lattice cryptanalysis state of the art. Additionally KYBER's public key and cipher-text sizes are on the order of a thousand bytes, which should be acceptable for most applications [11]. Figure 6.…”

“…Figure 6. Key and cipher-text sizes (in bytes) for Kyber, adapted from [11] Compared with other KEM candidates Kyber has excellent performance both on software and hardware backed by the evidence so far supporting MLWE [11].…”

“…Additionally, the strong binding property may be useful for non-repudiation, since a unique public key and message identify a given Dilithium signature. Overall, it was considered efficient and easy to implement with a strong theoretical basis [11].…”

Distribution of controlled unitary quantum gates towards factoring large numbers on today’s small-register devices

“…In fact, integer factorization is the computational problem behind today’s most famous cryptosystem, the RSA (Rivest-Shamir-Adleman) cryptosystem, and thus a lot of work has went into developing increasingly sophisticated attacks, based on everything from approximation algorithms to quantum computing. Recently, a PQCrypto 2014 talk 2 estimated that by 2030 a billion-dollar quantum computer could break 2000-bit RSA in a few hours, a figure that was taken by NIST as a serious long-term threat to the cryptosystems currently standardized by NIST 1 , a process which ultimately kicked off a competition to determine the best candidate to replace today’s most popular cryptosystem whose third round finished in late 2021 3 , with a replacement to be ready by 2024. The security of the communication protocols of tomorrow is thus heavily influenced by the advent of quantum computing.…”