Shaping a Quantum-Resistant Future: Strategies for Post-Quantum PKI

TL;DR

This paper discusses strategies for transitioning to a quantum-resistant Public Key Infrastructure by analyzing post-quantum algorithms and adapting existing protocols and certificate formats to ensure security against quantum threats.

Contribution

It defines requirements for a secure transition to quantum-resistant PKI and explores adaptations for X.509 certificates, CRLs, and OCSP supporting post-quantum algorithms.

Findings

Identifies key challenges in transitioning to quantum-resistant PKI

Proposes adaptations for X.509 certificates and related protocols

Provides comparative analysis of post-quantum algorithm suitability

Abstract

As the quantum computing era approaches, securing classical cryptographic protocols becomes imperative. Public key cryptography is widely used for signature and key exchange but it is the type of cryptography more threatened by quantum computing. Its application typically requires support via a public-key certificate, which is a signed data structure and must therefore face twice the quantum challenge: for the certified keys and for the signature itself. We present the latest developments in selecting robust Post-Quantum algorithms and investigate their applicability in the Public Key Infrastructure context. Our contribution entails defining requirements for a secure transition to a quantum-resistant Public Key Infrastructure, with a focus on adaptations for the X.509 certificate format. Additionally, we explore transitioning Certificate Revocation List and Online Certificate Status Protocol to support quantum-resistant algorithms. Through comparative analysis, we elucidate the complex transition to a quantum-resistant PKI.