Learning Objectives:

  • Understand the NIST post-quantum cryptography standards and algorithms.

  • Analyse the performance and resource constraints of PQC algorithms.

  • Develop a roadmap for quantum-safe migration.

  • Recognise the importance of cryptographic agility and inventory management.

5.1 NIST Post-Quantum Cryptography Standards

NIST has released three final post-quantum encryption standards developed through an open and transparent process that involved researchers worldwide . The standards are built on mathematical problems with over three decades of research behind them, giving continued confidence in their security .

Key NIST Standards:

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism): A lattice-based scheme for key establishment, intended to support secure key exchange in environments such as payments and post-trade processing .

ML-DSA (Module-Lattice-Based Digital Signature Algorithm): A lattice-based scheme for digital signatures, designed to support secure transaction authorisation .

SLH-DSA (Stateless Hash-based Digital Signature Standard): A hash-based signature scheme, often cited for use cases that require long-term verification, including regulatory records and archival data .

While these algorithms introduce larger keys and additional processing overhead, they provide a practical foundation for staged, hybrid adoption, allowing financial institutions and market infrastructures to strengthen resilience while standards and operational practices continue to mature .

5.2 Performance and Resource Constraints

The introduction of post-quantum cryptography comes with performance and resource implications. BIS’s Project Leap demonstrated that post-quantum cryptography leads to significantly higher processing time than traditional algorithms, which will need to be taken into consideration when planning migration . The experiments highlighted the need for more testing and the importance of cryptographic agility as standards evolve .

A recent ScienceDirect research paper systematically investigated the applicability of post-quantum cryptographic algorithms to financial applications, considering their unique constraints and security requirements . The paper proposed a comprehensive framework to guide algorithm selection, providing financial institutions with the tools necessary to transition to quantum-safe systems effectively .

5.3 Building a Quantum-Safe Migration Roadmap

Building resilience starts with understanding an organisation’s cryptographic landscape. A complete inventory of cryptographic assets helps identify where they’re used, their properties and vulnerabilities, and how critical they are to the business .

Key Migration Steps:

Discovery and Inventory: Identify where cryptography is used across systems, applications, and data flows. The MAS will set progressive timelines for financial institutions to establish an inventory of their cryptographic assets .

Vulnerability Assessment: Assess the vulnerability of cryptographic assets to quantum attacks.

Prioritisation: Develop a prioritisation of the migration of vulnerable assets to quantum-resilient solutions .

Migration Planning: Develop a roadmap for migration to post-quantum security standards. The MAS expects financial institutions to build technical capabilities and governance frameworks to support a quantum-safe migration .

Implementation: Implement post-quantum cryptography in a staged, hybrid manner.

Testing: Test post-quantum cryptography implementations.

Monitoring: Continuously monitor cryptographic assets and update as standards evolve.

5.4 Cryptographic Agility

Cryptographic agility—the ability to quickly update cryptography—is becoming increasingly necessary in a world of fast-changing technologies, threats, and standards . Agility alone cannot fully mitigate certain threats, such as “store now, decrypt later” attacks. A comprehensive strategy pairs agility with complementary measures, such as defence-in-depth . Cryptography defence-in-depth leverages multiple layers of cryptography to mitigate the risk of relying on a single solution .

The WFE report notes that the finalisation of PQC standards by NIST in 2024, which included algorithms for key exchange and digital signatures that are designed to resist both classical and quantum attacks, provides a stable reference point for preparedness discussions, even in the absence of binding implementation deadlines .

PreviousNext