PQC Standards
Quantum computers may one day break RSA and elliptic-curve cryptography. NIST has published the first post-quantum cryptography (PQC) standards.
- FIPS 203: ML-KEM (based on CRYSTALS-Kyber). Purpose: Key establishment.
- FIPS 204: ML-DSA (based on CRYSTALS-Dilithium). Purpose: Digital signatures, including certificates.
- FIPS 205: SLH-DSA (based on SPHINCS+). Purpose: Digital signatures, hash-based.
NIST IR 8547 (initial public draft) proposes a timeline: RSA and elliptic-curve algorithms at 112-bit security would be deprecated after 2030 and disallowed after 2035.
PQC readiness in PKI-as-a-Service
- 1. Discover: Use the Crypto Algorithm report to find every certificate by algorithm and key size.
- 2. Prioritise: Identify long-lived certificates and systems that protect data needing long-term secrecy.
- 3. Test: Build a separate test hierarchy with ML-DSA once supported by the CA software and HSM.
- 4. Migrate: Introduce post-quantum or hybrid CAs alongside the current hierarchy, then move certificates over time.
Because EC runs the hierarchy, new CAs can be added without changing the customer's own infrastructure.