Post-Quantum readiness for IoT

In the future, quantum computers are expected to break all the common forms of asymmetric cryptography used online today, like RSA and ECC. When this day will approach, commonly referred to as Q-Day, is subject to much debate. The good news is that symmetric encryption algorithms, such as AES, are thought to be secure against quantum computing threats.

While Q-Day may be many years off, the "Harvest Now, Decrypt Later" threat exists today. Bad actors collect encrypted data now. They plan to decrypt it later when they have a more powerful technology, like quantum computers.

This threat is worrying because even if data is encrypted now, it can still be valuable and sensitive later when decrypted. For instance, financial records, healthcare information, and personal data might be in danger. To protect against this, it is important to use strong, future-proof post-quantum cryptography (PQC). Interested to know more? see Post-Quantum Cryptography For Dummies

The industry is actively transitioning to post-quantum cryptography (PQC). This transition/change aims to guard against future threats from quantum computers. The National Institute of Standards and Technology (NIST) began replacing old asymmetric algorithms in 2017.

In 2024, new PQC standardsNIST announced the following new PQC standards:

NIST set the deprecation dates for old asymmetric algorithms. This aims to push the industry to adopt the new PQC standards.

Following NIST’s example, the NSA updated its Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) requirements for National Security Systems (NSS).

The NSA recommended guidance for:

The update requires PQC algorithms. It will also phase out current crypto algorithms. By January 1, 2027, all new acquisitions for NSS will be required to be CNSA 2.0 compliant unless otherwise noted. By December 31, 2030, all equipment and services that cannot support CNSA 2.0 must be phased out.

The push for PQC adoption in the US was further bolstered by the Executive Order 14144, signed by President Joe Biden on January 16, 2025, mandating US government adopt PQC. It is worth noting that this Executive Order was not overturned by President Trump when he took office.

Standards bodies, such as the IETF and CA/B Forum, are now working on adding support for these new algorithms to TLS 1.3 and the public trust ecosystem (browsers, public CAs, etc.). If you do not control both ends of the TLS session, like the web browser and web server, you will need two certificates; one is a pure PQC certificate, such as ML-DSA, and the other is a traditional certificate, like RSA. Having two certificates on each client and server complicates matters. Hence, industry groups are exploring hybrid x.509 certificates. These certificates combine existing methods with PQC. For example, they may use MLDSA-44, RSA 2048, and SHA256 together.

While symmetric ciphers used in TLS are safe from quantum computing threats, TLS sessions also rely on key agreement methods to establish a shared key. Currently, most TLS traffic uses X25519 for secure key exchange, a Diffie–Hellman-style key agreement. However, Shor's algorithm on a quantum computer can fully break its security. Therefore, the priority is to upgrade key agreement mechanisms to ML-KEM.

Key agreement allows secure key exchange, but it does not verify the identity of the parties involved. An attacker can intercept messages without authentication. They can also create separate key agreements with the browser and server, then re-encrypt those messages. Authentication is achieved using signatures. A website like https://digicert.com shows a certificate from a certification authority (CA). This confirms that the public key is owned by DigiCert. The server then signs the handshake and shared key with its private key, ensuring the client has agreed with the correct server.

Traditional signature schemes such as RSA and ECDSA are vulnerable to quantum attacks using Shor's algorithm. This means attackers can forge signatures and can also carry out man-in-the-middle (MitM) attacks. Upgrading to post-quantum signatures is important, but it is not urgent as it only needs to happen before quantum computers pose a threat. However, migrating to post-quantum signatures is complex and time-consuming.

NIST’s assignment of FIPS status to the new PQC algorithms affects IoT devices and connected products in several ways including but not limited to:

Broadly speaking, the impacts to your connected product can be categorized into:

Use the following checklists to discover how the various components of your connected production solution are impacted:

To prepare for the PQC, the industry has embraced a term from the US Department of Homeland Security - Cryptographic agility. This design feature allows updates to future cryptographic algorithms and standards. It does this without needing to change or replace the surrounding infrastructure - The US Department of Homeland Security.

Being “crypto agile” means being ready for new cryptographic threats; these threats come from quantum computers and other emerging technologies.

You do not have to wait until 2030 to start preparing

Phased approach to cryptographic agility

Discover

Test

Deploy

Automate your device fleet software updates and issuance of PQC certificates utilizing an integrated device management, OTA update service and certificate lifecycle management solution such as DigiCert’s Device Trust Manager.

Manage

Automate software updates and certificate lifecycle across devices with scalable and automated management tools such as DigiCert’s Device Trust Manager.

All DigiCert Device Trust solutions built atop the DigiCert ONE platform are PQC-ready

DigiCert Device Trust Manager is PQC ready and supports:

DigiCert TrustEdge - our free security CLI for Linux devices - is PQC ready with support for generating ML-DSA keypairs, creating a CSR and sending a CSR to a PKI over EST or SCEP, all through a simple, free-to-download CLI.

DigiCert TrustCore SDK - our C-SDK embedded security toolkit - is PQC ready with support for ML-KEM, ML-DSA, TLS 1.3 and FIPS 140-3 certified crypto. Labs.digicert.com - our free PQC playground allowing you to quickly create PQC certificates for testing purposes.