Cómo a Usar Post-Quantum Cryptography

问题

Shor's algoritmo irá break RSA y ECC una vez large-scale quantum computers arrive. You necesitar a transition a post-quantum cryptography (PQC) pero son unsure que algoritmos a choose y cómo a hybridize them safely.

Requisitos previos

• Understanding of public-key cryptography (RSA, ECDH, ECDSA)
• Familiarity with key encapsulation mechanisms (KEM) and digital signatures
• Knowledge of NIST PQC standardization process

Pasos

1. 1. Identify vulnerable cryptographic primitives

   Audit your system for RSA key exchange, RSA signatures, ECDH key exchange, and ECDSA signatures. These are all vulnerable to Shor's algorithm. Symmetric encryption (AES) and hashing (SHA-2/3) only lose half their security bits to Grover's algorithm, so AES-256 and SHA-256/512 remain quantum-safe with doubled key sizes.

   entrada

   RSA-2048, ECDH-P256, ECDSA-P256

   输出

   vulnerable: RSA-2048, ECDH-P256, ECDSA-P256 | safe: AES-256, SHA-256

2. 2. Select NIST-standardized PQC algorithms

   Use ML-KEM-768 (formerly Kyber) for key encapsulation, replacing ECDH/RSA key exchange. Use ML-DSA-65 (formerly Dilithium) for digital signatures, replacing RSA/ECDSA. For stateful hash-based signatures, use SLH-DSA (formerly SPHINCS+). ML-KEM-1024 and ML-DSA-87 provide NIST Level 5 security (equivalent to AES-256).

   entrada

   security level: 3 (AES-192 equivalent)

   输出

   KEM: ML-KEM-768 | signature: ML-DSA-65

3. 3. Implement hybrid key exchange

   Do not deploy PQC algorithms alone initially. Use a hybrid approach: combine classical ECDH with ML-KEM by XORing or concatenating the shared secrets. This ensures that if the PQC algorithm is later broken, the classical component still provides security, and vice versa. Generate both classical and PQC key pairs, perform both exchanges, then derive the final key with HKDF over the concatenated shared secrets.

   entrada

   ECDH-P256 + ML-KEM-768

   输出

   shared_secret = HKDF(ECDH_ss || MLKEM_ss)

4. 4. Test and validate the implementation

   Verify that the KEM decapsulation produces the correct shared secret. Test signature verification with valid and invalid signatures. Check that key sizes and ciphertext sizes match the NIST specifications (ML-KEM-768 public key: 1184 bytes, ciphertext: 1088 bytes). Use the hash tool to verify known-answer test vectors against NIST KAT vectors.

   entrada

   ML-KEM-768 KAT vector

   输出

   shared_secret matches reference

Resultado esperado

Un hybrid post-quantum cryptographic sistema usando ML-KEM y ML-DSA ese resists both classical y quantum attacks, con fallback seguridad de el classical componente.

Errores comunes

Deploying PQC algorithm without hybrid fallback

Always use hybrid mode (classical + PQC) during the transition period. If the PQC algorithm has an undiscovered flaw, the classical component preserves security.

Using superseded algorithm names (Kyber, Dilithium)

Use the NIST FIPS 203/204/205 standardized names: ML-KEM, ML-DSA, SLH-DSA. The older names refer to pre-standardization variants with different parameters.

Ignoring larger key and ciphertext sizes

PQC keys are much larger (ML-KEM-768 public key: 1184 bytes vs ECDH-P256: 32 bytes). Update protocols, buffers, and storage to accommodate these sizes.

Solución de problemas指引

• If performance is a concern, ML-KEM is faster than ECDH on most platforms, but ML-DSA signatures are larger than ECDSA. Benchmark on your target hardware.
• For TLS, use the hybrid key exchange groups defined in IETF drafts (e.g., X25519MLKEM768) rather than custom combinations.
• If interoperability fails, verify you are using the same parameter set and that the implementation follows FIPS 203 exactly.

Límites de seguridad

• Post-quantum algorithms are newer and have less cryptanalytic maturity than RSA/ECC. Hybrid mode mitigates this risk.
• All cryptographic operations are performed locally; no keys or secrets are transmitted.
• PQC does not protect against all quantum attacks — Grover's algorithm still halves symmetric key security.