Comment en Utiliser Post-Quantum Cryptography

问题

Shor's algorithme va break RSA et ECC une fois large-scale quantum computers arrive. You besoin en transition en post-quantum cryptography (PQC) mais sont unsure qui algorithmes en choose et comment en hybridize them safely.

Prérequis

• Understanding of public-key cryptography (RSA, ECDH, ECDSA)
• Familiarity with key encapsulation mechanisms (KEM) and digital signatures
• Knowledge of NIST PQC standardization process

Étapes

1. 1. Identify vulnerable cryptographic primitives

   Audit your system for RSA key exchange, RSA signatures, ECDH key exchange, and ECDSA signatures. These are all vulnerable to Shor's algorithm. Symmetric encryption (AES) and hashing (SHA-2/3) only lose half their security bits to Grover's algorithm, so AES-256 and SHA-256/512 remain quantum-safe with doubled key sizes.

   entrée

   RSA-2048, ECDH-P256, ECDSA-P256

   输出

   vulnerable: RSA-2048, ECDH-P256, ECDSA-P256 | safe: AES-256, SHA-256

2. 2. Select NIST-standardized PQC algorithms

   Use ML-KEM-768 (formerly Kyber) for key encapsulation, replacing ECDH/RSA key exchange. Use ML-DSA-65 (formerly Dilithium) for digital signatures, replacing RSA/ECDSA. For stateful hash-based signatures, use SLH-DSA (formerly SPHINCS+). ML-KEM-1024 and ML-DSA-87 provide NIST Level 5 security (equivalent to AES-256).

   entrée

   security level: 3 (AES-192 equivalent)

   输出

   KEM: ML-KEM-768 | signature: ML-DSA-65

3. 3. Implement hybrid key exchange

   Do not deploy PQC algorithms alone initially. Use a hybrid approach: combine classical ECDH with ML-KEM by XORing or concatenating the shared secrets. This ensures that if the PQC algorithm is later broken, the classical component still provides security, and vice versa. Generate both classical and PQC key pairs, perform both exchanges, then derive the final key with HKDF over the concatenated shared secrets.

   entrée

   ECDH-P256 + ML-KEM-768

   输出

   shared_secret = HKDF(ECDH_ss || MLKEM_ss)

4. 4. Test and validate the implementation

   Verify that the KEM decapsulation produces the correct shared secret. Test signature verification with valid and invalid signatures. Check that key sizes and ciphertext sizes match the NIST specifications (ML-KEM-768 public key: 1184 bytes, ciphertext: 1088 bytes). Use the hash tool to verify known-answer test vectors against NIST KAT vectors.

   entrée

   ML-KEM-768 KAT vector

   输出

   shared_secret matches reference

Résultat attendu

Un hybrid post-quantum cryptographic système utilisant ML-KEM et ML-DSA ce resists both classical et quantum attacks, avec fallback sécurité de le classical composant.

Erreurs courantes

Deploying PQC algorithm without hybrid fallback

Always use hybrid mode (classical + PQC) during the transition period. If the PQC algorithm has an undiscovered flaw, the classical component preserves security.

Using superseded algorithm names (Kyber, Dilithium)

Use the NIST FIPS 203/204/205 standardized names: ML-KEM, ML-DSA, SLH-DSA. The older names refer to pre-standardization variants with different parameters.

Ignoring larger key and ciphertext sizes

PQC keys are much larger (ML-KEM-768 public key: 1184 bytes vs ECDH-P256: 32 bytes). Update protocols, buffers, and storage to accommodate these sizes.

Dépannage指引

• If performance is a concern, ML-KEM is faster than ECDH on most platforms, but ML-DSA signatures are larger than ECDSA. Benchmark on your target hardware.
• For TLS, use the hybrid key exchange groups defined in IETF drafts (e.g., X25519MLKEM768) rather than custom combinations.
• If interoperability fails, verify you are using the same parameter set and that the implementation follows FIPS 203 exactly.

Limites de sécurité

• Post-quantum algorithms are newer and have less cryptanalytic maturity than RSA/ECC. Hybrid mode mitigates this risk.
• All cryptographic operations are performed locally; no keys or secrets are transmitted.
• PQC does not protect against all quantum attacks — Grover's algorithm still halves symmetric key security.