CONTACT
The National Institute of Standards and Technology (NIST) in the United States is advancing the standardization of post-quantum cryptographic algorithms in preparation for the evolution of quantum computers. In August 2024, three out of four candidate algorithms were officially recognized as “Federal Information Processing Standards (FIPS).” These cryptographic methods aim to withstand potential cyberattacks from future quantum computers, significantly impacting the financial industry.
This article will discuss the emerging post-quantum cryptography standards, explore the fundamental principles of quantum computing, and outline the practical pathways for its implementation, along with the “light and shadow” it brings to the finance sector.
Written by: Makoto Shibata, Head of FINOLAB
What Are the Post-Quantum Cryptography Standards Announced by NIST?
(Photo/Shutterstock.com)
Table of Contents:
- The National Institute of Standards and Technology (NIST) Announces “Standards” for Post-Quantum Cryptography
- The “Fundamental Principles” of Quantum Computers and Their Current State of Practical Application
- The “Light and Shadow” of Quantum Computers in the Financial Sector
- Three “Post-Quantum Cryptography Standards” Released by the National Institute of Standards and Technology
- Prospects for “Quantum Computing and Finance”
The National Institute of Standards and Technology (NIST) Announces “Standards” for Post-Quantum Cryptography
On August 13, the National Institute of Standards and Technology (NIST) officially recognized three out of four previously developed post-quantum cryptography (PQC) algorithms as Federal Information Processing Standards (FIPS).
These algorithms are designed to withstand future cyberattacks that may leverage quantum computers, and NIST has recommended their use for secure applications.
This article will outline the background of the standardization process and its significant implications for the financial industry, as well as summarize the details of the released algorithms.
Three types of post-quantum cryptography were announced on the NIST website.
（Source：NIST）
The “Fundamental Principles” of Quantum Computers and Their Current State of Practical Application
Quantum computers are a new type of computer that utilize the principles of quantum mechanics for computation.
In contrast to traditional computers (classical computers), which use bits that can be in one of two states (0 or 1) and perform calculations based on whether an electrical current flows or not, quantum computers use quantum bits (qubits) that can exist in both states simultaneously (a phenomenon known as “quantum superposition”). This capability allows quantum computers to perform many calculations in parallel.
Additionally, quantum computers leverage a phenomenon called “quantum entanglement,” which enables qubits to be strongly correlated, allowing for more complex calculations to be performed efficiently. This means that for certain problems, quantum computers could potentially solve calculations that would take classical computers an extremely long time to complete.
The theoretical expectation is that once quantum computers are fully realized, tasks such as factorizing large numbers (in the range of thousands of digits) that currently take supercomputers hundreds of years could be accomplished in mere seconds or hours. However, many experts believe that given the current technical challenges, it may still take over a decade to achieve this level of capability.
Currently, quantum computers are classified as “Noisy Intermediate-Scale Quantum” (NISQ) devices, which tend to experience many errors and are difficult to operate stably over long periods.
Despite these challenges, recent advancements in “quantum error correction technology,” the development of new codes (like GKP), and improvements in hardware efficiency through superconducting methods and ion trap technologies have raised hopes for breakthroughs that could shorten the timeline to practical applications.
Moreover, before the development of general-purpose quantum computers, there has been progress in the practical application of “quantum annealing,” a method of quantum computing that accelerates specific calculations, such as optimization problems. This technology is beginning to be utilized in fields such as drug discovery, compound generation, route calculation, and shift management.
“IBM Quantum System One,” a quantum computer installed in Japan, and the author.
The “Light and Shadow” of Quantum Computers in the Financial Sector
The practical implementation of quantum computers is expected to have various impacts on financial services, and it is believed that these sectors will benefit from the advancements in quantum computing in the following ways:
Improvement in Investment Performance
Quantum computers have the potential to execute complex calculations quickly that current computers struggle to handle, particularly in risk management and portfolio optimization. This advancement would allow financial institutions to conduct more sophisticated risk assessments and develop investment strategies, leading to improved investment performance.
Enhanced Predictive Accuracy
Utilizing the high-speed computational capabilities of quantum computers could significantly enhance the accuracy of financial market predictions. In high-frequency trading (HFT), for example, the ability to predict market trends instantaneously would allow for optimal trading, thus increasing competitive advantage.
Advancement of Derivative Operations
Quantum computing’s advanced computational power could also be beneficial in evaluating and simulating complex derivatives (financial derivatives). This would enable real-time risk hedging and pricing, allowing for quicker and more accurate financial services.
Upgraded Scoring Models
In credit risk assessment, the use of quantum computers is anticipated to yield improvements as well. They can quickly analyze vast amounts of data to create more accurate credit scoring models, streamlining the approval processes for loans and credit cards.
Enhanced Fraud Detection
With the ability to rapidly detect complex patterns, quantum computers are expected to play a significant role in identifying financial fraud. By combining AI with quantum computing, real-time fraud detection can become more accurate, helping protect financial institutions and their customers.
However, current financial transactions rely on public-key cryptography for security. This system is based on mathematical problems that are difficult to solve with classical computers, such as factoring large integers (e.g., RSA encryption) and the discrete logarithm problem (e.g., DSA – Digital Signature Algorithm).
As quantum computers advance, they may be able to solve these problems quickly, rendering traditional encryption methods vulnerable. This raises several concerns regarding the security of financial services:
Transaction Security
Many digital financial transactions, including online banking, depend on public-key cryptography to ensure data authenticity. If quantum computers become operational, there is a risk that encrypted transaction messages could be decoded instantly, leading to potential fraud.
Privacy Protection
Customer personal data held by financial institutions is encrypted for security. However, if quantum computers enhance decryption capabilities, the risk of data breaches increases, which could lead to privacy violations.
Effectiveness of Timestamps
Should quantum computers be able to decrypt public-key encryption’s private keys, attackers could generate new signatures on historical data, allowing them to create altered timestamps. This could mislead users about when data or transactions actually occurred, making it difficult to detect tampering.
The risk of such vulnerabilities in encryption has significant implications for many industries as digitalization advances. In the financial services sector, information security is a critical requirement for business operations. Consequently, there is a growing need to explore new cryptographic algorithms to address the risks posed by the practical implementation of quantum computers.
Transitioning to new encryption methods requires considerable time and cost, and given the potential for timestamp tampering, it is essential to begin changing these methods immediately.
NIST (National Institute of Standards and Technology) has stated that “due to the evolution of quantum computers, existing RSA encryption (2048-bit key length) may be broken by 2030.” As a result, NIST began serious consideration of new quantum-resistant cryptographic technologies in 2016.
Three “Post-Quantum Cryptography Standards” Released by the National Institute of Standards and Technology
The three algorithms that have become FIPS standards (203, 204, and 205) consist of one key exchange algorithm and two electronic signature algorithms (one of which serves as a backup).
This standard incorporates a “Key Encapsulation Mechanism (KEM)” designed to facilitate key exchange for general encryption and data confidentiality. The standard adopts the lattice-based algorithm “CRYSTALS-Kyber,” which has been renamed to “ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism).”
This standard adopts the lattice-based electronic signature algorithm “CRYSTALS-Dilithium.” Its name has been changed to “ML-DSA (Module-Lattice-Based Digital Signature Algorithm).”
This standard incorporates the electronic signature algorithm “SPHINCS+,” which uses a hash function. The algorithm has been renamed “SLH-DSA (Stateless Hash-Based Digital Signature Algorithm).” This algorithm is intended as a backup in case the ML-DSA proves to be vulnerable.
Prospects for “Quantum Computing and Finance”
In addition to the three types of algorithms released this time, a new standard is scheduled to be published in the second half of 2024:
FIPS 206
This standard will adopt the electronic signature algorithm “FALCON,” which utilizes lattice cryptography. The algorithm’s name will be “FN-DSA,” which stands for Fast Fourier Transform (FFT) over NTRU-Lattice-Based Digital Signature Algorithm.
NIST announced the four final candidates for post-quantum cryptography algorithms in July 2022.
（Source: NIST）
NIST recommends the prompt implementation of these new standards into systems. Additionally, NIST is evaluating other candidate algorithms, which could lead to the inclusion of more standards in the future, providing a layered security approach capable of addressing complex attacks.
Alongside the algorithms that are difficult to decipher even with quantum computers, the development of Quantum Key Distribution (QKD) technology, which utilizes principles of quantum mechanics to securely share cryptographic keys, is also progressing. QKD offers a physically secure communication channel, protecting against eavesdropping and tampering. Various methods, such as fiber-optic and satellite communication, are being developed, though implementing them on a large scale for long-distance networks will still take time.
Considering the future cryptographic methods for financial transactions, it is essential to plan a shift from existing methods in line with the technological advancements in quantum computing. However, there is no immediate urgency for the implementation of NIST’s newly published post-quantum cryptography standards. Nonetheless, for long-term effective timestamps that could be subject to retrospective tampering, a swift review of the cryptographic algorithms used in electronic signatures is advisable.