CISA officials will issue guidance sometime this month that will focus on how to prioritize cryptographic systems and automation to help make them quantum resistant. John D/Getty Images
Feds' quantum encryption shift is most 'comprehensive' ever done, official says
Office of the National Cyber Director official Dylan Presman said there has been “nothing like this” effort to move critical assets to quantum-resistant encryption standards.
The federal government is in the midst of roadmapping the overhaul of digital networks with post-quantum cryptographic standards ahead of the advent of a viable, fault-tolerant quantum computer, per directives outlined in a May 2022 national security memorandum.
Speaking during the Quantum World Congress in Virginia on Thursday, several federal officials overseeing aspects of the pending migration discussed the scale of federal efforts and advised entities planning their own transitions.
“The federal government is just slowly implementing complex transitions,” said Dylan Presman, director for budget and assessment at the White House Office of the National Cyber Director. “We've never had a transition this comprehensive. There have been cryptographic transitions in the past but nothing like this.”
The network assets that demand priority are referred to as high impact systems and high value assets. Nicholas Polk, senior advisor to the federal CISO, explained that high-impact systems are those that have a direct public safety or economic impact, such as those of the Federal Emergency Management Agency or Centers for Disease Control and Prevention.
High-value assets, however, refer to the targets within digital systems that contain sensitive data or are otherwise critical to network operations for a given organization.
“We have a lot of critical public-facing services,” Polk said. “So we need to make sure that we defend [those] first, especially as they hold a lot of Americans’ personal information, personal health information… classified information has a 50 year life span.”
Responsibility to migrate to and test a successful post-quantum cryptographic standard will also hinge on technology product vendors supporting their clients through these transitions.
“As organizations consider what they're purchasing and what they're implementing, they should understand that they may need to change their algorithms out again in the future,” Lowry said.
In support of the process, Presman confirmed that CISA will offer support for organizations in their inventory process and release guidance within the next month focused on automation and how to prioritize cryptographic systems in partnership with the National Institutes of Standards and Technology.
“We know it's a heavy lift in the departments and agencies, we know it's going to be a heavy lift in industry,” he said, acknowledging the high variability of migration timelines given the pending release of standardized post-quantum cryptographic algorithms by NIST in 2024.
“We’ll get better as we get to a point of implementation,” Presman added, estimating that actual implementation of new algorithms is unlikely to occur until 2025 or 2026.
Officials agreed that a thorough system inventory will be crucial to understanding where organizations need to begin modernizing from standard public key encryption to quantum-resistant encryption.
“Our recommendation is very similar to what the U.S. government is undertaking internally and that's first to conduct an inventory, to know what you have and know what you need to prioritize,” said Christian Lowry, section chief at the Cybersecurity and Infrastructure Security Agency.
Lowry acknowledged that there are no federal mandates that force organizations to begin to upgrade their networks, but that with the anticipated advent of a viable quantum computer capable of operating within the next decade, private and public entities alike should take steps to protect their data soon, especially critical infrastructure operators.
“One of the things we want to emphasize basically is just that it should be a deliberate process,” Lowry said. “You should be planning this out in advance, you should not be doing it on the fly because the [information and communications technology] supply chain consideration is easy to overlook if you don't have a plan in place and a schedule in place to actually execute this over time.”