后量子密码迁移白皮书（2024）

2024 ()LRINFO v 辛梓焜 Post-quantum cryptographyPQCQuantum-resistant cryptographyQRCQuantum cryptographyQC NISTLRINFO + NISTNIST 1 1.111.251.2.151.2.27 10 2.1102.213LRINFO 19 3.1.1193.1.222 3.223 3.327 3.428 29 4.129 4.1.1304.1.2314.1.332 4.234 4.2.134 4.2.238 4.2.340 4.345 4.3.1464.3.2484.3.3504.3.450LRINFO 52 5.1525.2PQ-SSH565.3PQ-TLS585.4PQ-PKI67 72 6.1726.280 85 7.1857.2867.386 1.1 1 •LRINFO •/ • [17]AESZUC SM4(Confidentiality) SHASM3(Integrity) RSAECC SM2CACA(Authenticity)LRINFO SSL/TLSSSHPKI TLS/SSL(Secure Sockets Layer)TLS (transport layer security)TLSTCP/IPTLSHTTPS (HTTP over TLS)TLSHTTPChromeInternetExplorerHTTPS[17]LRINFO SSH(Secure SHell)SSHTelnetRloginSSHAESRSASSHOpenSSHLinuxSSH PKI(Public Key Infrastructure)PKICAPKI(Relying Party)PKICACAX.509X.509TLS/SSLX.509CALRINFO 1.2 1.2.1 AESZUC SM3/SM419491 AES-2562562256256 GroverSimonsO(√N)O(N),Grover,Simon[18]2018Grover+Simonr-n-FeistelO(n2(r−3)n/4)O(n2)[19]LRINFO [18][18]Grover+Simon 1.2.2 1994Peter ShorShorHidden Subgroup Problem,HSPRSA/Diffie-HellmanElgamal/Schnorr/DSAECDSAED25519 SM220225SandboxAQNature[20]Store-now-decrypt-laterSNDLSNDLLRINFO SNDLShor202017Shorn2n+2,n9n+logn2[21]22048RSA256ECC2500∼4000LRINFO 20351320212048RSA2000842024IBM122881/48100[23]IBM RSAECC10RSAECC10RSAECC2023RegevShor305nShorO(n2logn)O(n3/2logn)ShorO(n)O(n3/2)Regev62024MITRagavanVaikuntanathanO(nlogn)O(n3/2logn)LRINFO 2.1 5LRINFO LatticeGeometry ofnumbersSVPCVPAjtaiRegevSISLWESISLWENIST 1978McElieceClassical-McElieceGoppaMcElieceNIST-PQCFinalistsLRINFO NPHFEv-GeMSSUOVRainbowNIST-PQC20227AlternatesFinalists MerkleMSSXMSSSPHINCS+XMSSMSSSPHINCS+MerkleGoldreichSPHINCSHashHashHashLRINFO Diffie-HellmanSIDHCSIDHECDH2011JaoDiffie-HellmanSIKE SIKE20227NIST-PQC1SIKE 2.2 1NIST-PQCLRINFO National Institute of Standards andTechnologyNIST20167692615FinalistsAlternatesFinalists7KyberNTRUSABERClassic McEliece4DilithiumFalconRainbow3Alternates8BikeFrodoKEM HQC NTRUprime SIKE5GeMSSPicnic Sphincs+3 20227NISTNIST IR 8413[24] NIST202361408 20238NIST/Crystals-Kyber[25]Crystals-Dilithium[26]FalconSPHINCS+[27]2024NISTRSADiffie-HellmanLRINFO NIST-PQC7LAC8 2NIST 2 NIST2020[28]NIST-PQCNIST4BSI[7]ANSSI[12]AIVD[8]PQCNIST Bundesamt für Sicherheit in der In-formationstechnikBSIFrodoKEMClassic McElieceKyberBSITR-02102-1NISTFrodoKEMClassic McElieceBSIISOPWI19541[29]Agence nationale de la sécurité des systèmes d’informationANSSINIST-PQCNIST(AlgemeneInlichtingenen Veiligheidsdienst, AIVD)SPHINCS-256XMSSLRINFO 3 NCSCML-KEM-768ML-DSA-65NIST[30]PQCNISTPQC Australian Cyber Security Cen- treACSCPQCNIST(GCSB)PQCNISTPQC NISTPQCKpqC92021[9]2023158202411 ETSIIETFIEEEISOETSIGR QSC001IETF RFC 8391XMSS:eXtended MerkleSignature SchemeIEEE 1363.1-2008IEEE Standard Specificationfor Public Key Cryptographic Techniques Based on Hard Problems overLatticesLRINFO 4 20186CACR[31]201912143 20232023[32]2024[33][34] LRINFO 3.1 3.1.1 1 20235NIST[1-3]NISTSP 1800-38ANIST SP 1800-38BNIST SP 1800-38C 2023(ISED)[35]PQCPQCPQC[35] 20198Institute for Monetaryand Economic Studies Bank of JapanIMES BOJ[10]LRINFO 20237The Ministry of Science and ICTMSITPOC2035PQC[11] 20235ACSCPQC[13] 20233AIVD TNO CWIPQCPQC[36] 2 202254 [37]Quantum Information Science, QIS202368QuSecureSBIR[38]2023627SandboxAQ[39]2023830QuSecureAFGSCSBCC[40]LRINFO 20226[41]20229(DTCC)PQC[42]20229PQC[43]PQC 2023217GSMA PQTNPQ.01 [4]2023922GSMAPQTNPQ.02(QRM)[5]2024222GSMAPQTNPQ.03[6] 3.1.2 2023410-15[14]202311[15]LRINFO 20222022 Kyber20245LMS/HSS-SM3KyberDilithiumLRINFO 202311[16]MPCPSIPIRFLPrivTorrentQuantum Shield 3.2 1 2LRINFO 2 a.PQCb.LRINFO 3 a.b. c. 4 a.LRINFO b. c.PQC d. 3.3 AESRSAECCSSL/TLSLRINFO 3.4 SPHINCS+Kyber768TLSHelloClientLRINFO SIKE 4.1 3 LRINFO 4 IDE4LRINFO 4.1.2 5 x64LinuxWindows(EDR) 4.1.3 6 4.2 LRINFO 4.2.1 1IBM IBMIBMz16z/OSIBMVPNNCCoEIBM 4 IBM 2 SaaS 3Infosec Global (ISG) ISGISGISGSSL 6 ISG 4 SandboxAQSecurity SuiteISARA Corporation 4.2.2 48 4.2.3 Windows 1 IDE • –RSA/–ECDSA/ •–KeyPairGenerator, KeyFactory, Signature, SignatureExceptionJava IDELRINFO IDE 1. 2. 1.2.3.4.5. 2 Windows 11 ••Java•OpenVPN•GRR Windows 1. 2. Windows 1.Windows 10/112.3.4.5. 3 TLS TLS •LRINFO • 1.4 2.IP 3.tcpreplayTLS 1.2 // SSH SSH •AZSecure DataAZSecure • 1.4 2.IP 3.tcpreplaySSH 2.0 ,(SSH)(KEX)/ 4.3 PQCQRACARAFQRACARAF QRA 4.3.1 1 LRINFO zx+yxyITz QRANIST[44] •••2z•xzy•"x + y > z "•LRINFO (2)CARAF [45]CARAF[46] •1 •2•3=xCARAF=x•4•5LRINFO 4.3.2 (FS-ISAC) FS-ISAC[47]CARAF CAICAICAICAISWIFTFS-ISAC PQCPQCLRINFO FS-ISAC PQC •••••••• 4.3.3 CPS[48]PASTA PASTA ••••••STRIDE•LRINFO 4.3.4 [49] •1•2•3•4•5•6•7•8LRINFO 5.1 NIST20227NISTNIST IR 8413/Crystals-KyberFIPS.203Crystals-DilithiumFIPS.204FalconSPHINCS+FIPS.205LRINFO NISTBSIANSSINLNCSANISTBSIFrodoKEMClassic McElieceKyberBSI TR-02102-1FrodoKEMNISTClassicMcElieceBSIISOPWI 19541 AWSCrypto4a CryptoNext Entrust IBM ISCUtimacowolfSSL10SS