Post-Quantum Cryptography (PQC) Migration Guide for Financial Institutions

Abstract

The development of quantum computers has become a hot topic in the technology world. The emergence of quantum computers has subverted our imagination of computers. Quantum computing is also expected to solve some of the challenges facing our planet, including the environment, agriculture, health, energy, climate, and materials science. For some of these problems, with the growth of the system, traditional computing is increasingly challenged. Quantum systems will have capabilities beyond today's most powerful supercomputers. For example, in today's computer security systems, encryption and digital signature technologies must be used. As early as 1994, Peter Shor discovered a quantum algorithm that can be used for integer decomposition. Its execution speed will be exponentially faster than the best known traditional algorithms, and it can crack many public key cryptography systems that are the basis of today's e-commerce security, including RSA and Elliptic Curve Cryptography. Once a quantum computer is successfully manufactured, attackers will be able to crack the main public key cryptography systems used in the world today. Therefore, we need to prepare in advance to avoid the destructive impact on current cryptography. In order to deal with the potential threat of quantum cracking, the US NIST announced the Post-Quantum Cryptography (PQC) standard selected after 8 years on August 13, 2024, including 3 new Federal Information Processing Standards (FIPS), which are FIPS 203, FIPS 204 and FIPS 205 respectively. The 4th PQC standard will be launched at the end of 2024. Therefore, evaluating the adoption of Post-Quantum Cryptography (PQC) to ensure data security, and the migration plan of Post-Quantum Cryptography is an urgent task.