The Post-Quantum Cryptography Coalition, or PQCC, a community of leading cybersecurity organizations such as MITRE, has published a guide for transitioning to quantum-safe cryptography.
The Post-Quantum Cryptography, or PQC, Migration Roadmap empowers chief information and chief information security officers to more proactively protect data against current and future threats, said Wen Masters, vice president of cyber technologies at MITRE.
“As quantum computing technology continues to advance, organizations cannot afford to delay preparing for these transformative changes and threats to their security,” the official commented.
PQC Adoption Framework
The document is divided into four categories: preparation, baseline understanding, planning and execution, and monitoring and evaluation.
The preparation category provides information about assessing an organization’s vulnerabilities, identifying goals and setting up a timeline for migration. Although the technology needed to crack traditional cryptography is not yet available, adversaries may harvest sensitive information from a target organization now and then decrypt later on. The type of data an organization protects, therefore, dictates the urgency of adopting PQC.
The coalition also advises organizations to assign a leader to oversee migration and to create an inventory of electronic assets as part of their preparation for PQC.
The second category focuses on ensuring that the organization has a baseline understanding of its data inventory and assets and the available resources to support migration. These factors, according to the document, will enable organizations to prioritize assets to be updated and determine future activities.
At this point, organizations are advised to begin exploring cryptographic algorithms for each asset.
For category three, or planning and execution, organizations must decide which PQC solutions should be acquired commercially or developed internally. PQCC also said organizations must create short-term measures to ensure that sensitive systems and information are protected from ‘harvest now, decrypt later’ attacks.
The final category, monitoring and evaluation, involves tracking the organization’s migration process and establishing a way to assess cryptographic security in response to the evolving quantum landscape.
The Post-Quantum Cryptography Coalition also includes Microsoft, IBM Quantum, PQShield, SandboxAQ and the University of Waterloo.
