耐量子暗号を使う方法

问题

大規模量子コンピューターが実現すると、Shor のアルゴリズムによって RSA と ECC は破られます。耐量子暗号（PQC）へ移行する必要がありますが、どのアルゴリズムを選び、どう安全にハイブリッド運用すればよいかがわかりません。

前提条件

• 公開鍵暗号（RSA、ECDH、ECDSA）の理解
• 鍵カプセル化機構（KEM）とデジタル署名への習熟
• NIST の PQC 標準化プロセスに関する知識

ステップ

1. 1. Identify vulnerable cryptographic primitives

   Audit your system for RSA key exchange, RSA signatures, ECDH key exchange, and ECDSA signatures. These are all vulnerable to Shor's algorithm. Symmetric encryption (AES) and hashing (SHA-2/3) only lose half their security bits to Grover's algorithm, so AES-256 and SHA-256/512 remain quantum-safe with doubled key sizes.

   入力

   RSA-2048, ECDH-P256, ECDSA-P256

   输出

   vulnerable: RSA-2048, ECDH-P256, ECDSA-P256 | safe: AES-256, SHA-256

2. 2. Select NIST-standardized PQC algorithms

   Use ML-KEM-768 (formerly Kyber) for key encapsulation, replacing ECDH/RSA key exchange. Use ML-DSA-65 (formerly Dilithium) for digital signatures, replacing RSA/ECDSA. For stateful hash-based signatures, use SLH-DSA (formerly SPHINCS+). ML-KEM-1024 and ML-DSA-87 provide NIST Level 5 security (equivalent to AES-256).

   入力

   security level: 3 (AES-192 equivalent)

   输出

   KEM: ML-KEM-768 | signature: ML-DSA-65

3. 3. Implement hybrid key exchange

   Do not deploy PQC algorithms alone initially. Use a hybrid approach: combine classical ECDH with ML-KEM by XORing or concatenating the shared secrets. This ensures that if the PQC algorithm is later broken, the classical component still provides security, and vice versa. Generate both classical and PQC key pairs, perform both exchanges, then derive the final key with HKDF over the concatenated shared secrets.

   入力

   ECDH-P256 + ML-KEM-768

   输出

   shared_secret = HKDF(ECDH_ss || MLKEM_ss)

4. 4. Test and validate the implementation

   Verify that the KEM decapsulation produces the correct shared secret. Test signature verification with valid and invalid signatures. Check that key sizes and ciphertext sizes match the NIST specifications (ML-KEM-768 public key: 1184 bytes, ciphertext: 1088 bytes). Use the hash tool to verify known-answer test vectors against NIST KAT vectors.

   入力

   ML-KEM-768 KAT vector

   输出

   shared_secret matches reference

期待される結果

ML-KEM と ML-DSA を用い、古典攻撃と量子攻撃の両方に耐性を持つハイブリッド耐量子暗号システム。古典成分によるフォールバックセキュリティも備えます。

よくあるエラー

Deploying PQC algorithm without hybrid fallback

Always use hybrid mode (classical + PQC) during the transition period. If the PQC algorithm has an undiscovered flaw, the classical component preserves security.

Using superseded algorithm names (Kyber, Dilithium)

Use the NIST FIPS 203/204/205 standardized names: ML-KEM, ML-DSA, SLH-DSA. The older names refer to pre-standardization variants with different parameters.

Ignoring larger key and ciphertext sizes

PQC keys are much larger (ML-KEM-768 public key: 1184 bytes vs ECDH-P256: 32 bytes). Update protocols, buffers, and storage to accommodate these sizes.

トラブルシューティング指引

• If performance is a concern, ML-KEM is faster than ECDH on most platforms, but ML-DSA signatures are larger than ECDSA. Benchmark on your target hardware.
• For TLS, use the hybrid key exchange groups defined in IETF drafts (e.g., X25519MLKEM768) rather than custom combinations.
• If interoperability fails, verify you are using the same parameter set and that the implementation follows FIPS 203 exactly.

セキュリティ上の制限

• Post-quantum algorithms are newer and have less cryptanalytic maturity than RSA/ECC. Hybrid mode mitigates this risk.
• All cryptographic operations are performed locally; no keys or secrets are transmitted.
• PQC does not protect against all quantum attacks — Grover's algorithm still halves symmetric key security.