Post Quantum Cryptography (PQC) Readiness and Validation Status

Scope

Federal agencies are preparing for the transition from cryptographic algorithms that may be vulnerable to future quantum computing attacks to quantum-resistant cryptographic algorithms standardized by the National Institute of Standards and Technology (NIST).

Public key cryptographic algorithms (i.e. asymmetric cryptography) currently used across Federal information systems, products and services — including Rivest-Shamir-Adleman (RSA), elliptic curve Diffie-Hellman(ECDH), elliptic curve digital signature algorithms (ECDSA), and related mechanisms — will be vulnerable to a future cryptanalytically relevant quantum computer (CRQC).

As a result, Federal agencies are expected to identify, prioritize, and migrate quantum-vulnerable cryptographic systems to approved post-quantum cryptographic algorithms.

Federal agencies are also required to use validated cryptographic algorithms and modules when cryptography is required to protect Federal information or Federal systems.

The NIST Cryptographic Module Validation Program establishes requirements under FIPS 140-2 and FIPS 140-3.

FIPS 140-2 and FIPS 140-3 requirements are applicable to U.S.

Federal agencies when cryptographic-based security systems are used to provide information security for Federal operations and assets.

If cryptography is required for the protection of information or data, then FIPS-validated cryptography is applicable.

Non-validated cryptography shall be treated as providing no validated protection for Federal information where validated cryptography is required.

Relevant policy, standards, and guidance include, but may not be limited to: NIST Cryptographic Module Validation Program; FIPS 140-2 and FIPS 140-3, Security Requirements for Cryptographic Modules; FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism...