[论文解读] Identifying Research Challenges in Post Quantum Cryptography Migration and Cryptographic Agility

David J. Ott, Christopher Peikert+1 more|arXiv (Cornell University)|Sep 16, 2019

Quantum Computing Algorithms and Architecture被引用 31

一句话总结

本文基于一次汇聚了密码学家、应用密码学家及产业实践者的研究工作坊，识别出向后量子密码学（PQC）迁移及提升密码灵活性方面面临的关键研究挑战。论文提出了一套系统化的PQC迁移框架，并明确了构建灵活、面向未来的密码系统所需的基础研究需求。

ABSTRACT

The implications of sufficiently large quantum computers for widely used public-key cryptography is well-documented and increasingly discussed by the security community. An April 2016 report by the National Institute of Standards and Technology (NIST), notably, calls out the need for new standards to replace cryptosystems based on integer factorization and discrete logarithm problems, which have been shown to be vulnerable to Shor's quantum algorithm for prime factorization. Specifically, widely used RSA, ECDSA, ECDH, and DSA cryptosystems will need to be replaced by post-quantum cryptography (PQC) alternatives (also known as quantum-resistant or quantum-safe cryptography). Failure to transition before sufficiently powerful quantum computers are realized will jeopardize the security of public key cryptosystems which are widely deployed within communication protocols, digital signing mechanisms, authentication frameworks, and more. To avoid this, NIST has actively led a PQC standardization effort since 2016, leveraging a large and international research community. On January 31-February 1, 2019, the Computing Community Consortium (CCC) held a workshop in Washington, D.C. to discuss research challenges associated with PQC migration. Entitled, "Identifying Research Challenges in Post Quantum Cryptography Migration and Cryptographic Agility", participants came from three distinct yet related communities: cryptographers contributing to the NIST PQC standards effort, applied cryptographers with expertise in creating cryptographic solutions and implementing cryptography in real-world settings, and industry practitioners with expertise in deploying cryptographic standards within products and compute infrastructures. Discussion centered around two key themes: identifying constituent challenges in PQC migration and imagining a new science of "cryptographic agility".

研究动机与目标

• 为应对在大规模量子计算机出现之前，从经典安全的公钥密码系统向抗量子替代方案过渡的紧迫需求。
• 识别在现实系统、协议和基础设施中部署后量子密码学时存在的系统性挑战。
• 制定密码灵活性的研究议程——支持在面对新兴威胁时能够快速、安全地在不同密码算法间迁移。
• 弥合理论密码学、实际实现与产业部署之间在PQC迁移背景下的差距。
• 通过基于证据的研究优先级，为NIST及更广泛社区的标准化工作提供指导。

提出的方法

• 组织了一场为期多日的工作坊，汇聚了来自三个领域（密码学家、应用密码学家、产业实践者）的60多位专家。
• 通过结构化讨论聚焦于PQC迁移挑战及密码灵活性机制的设计。
• 将洞察整合为一份综合报告，识别出PQC采用过程中面临的技术、操作和系统性障碍。
• 将挑战划分为技术、部署和标准化三个维度，强调互操作性与长期可维护性。
• 提出以构建可动态切换算法、最小化中断的密码系统为核心的科研议程。
• 强调需要形式化模型与工具支持，以促进灵活密码协议的规格说明、验证与部署。

实验结果

研究问题

• RQ1 现有系统向后量子密码学迁移过程中，面临的主要技术、操作与组织挑战是什么？
• RQ2 如何设计密码系统以支持快速、安全且向后兼容的算法切换？
• RQ3 支撑未来抗密码分析进展的新型密码灵活性科学所需的关键需求是什么？
• RQ4 像NIST这样的标准化机构如何有效协调产业界与学术界，以确保PQC的及时且安全部署？
• RQ5 在支持大规模PQC迁移方面，当前在工具链、验证与部署框架方面存在哪些关键缺口？

主要发现

• 由于性能、兼容性与实现挑战，理论上的PQC算法与实际部署之间存在显著差距。
• 现有协议与系统并未为算法灵活性而设计，导致未来迁移成本高昂且易出错。
• 密码灵活性不仅需要协议层面的支持，还需在标准、工具与部署实践之间实现全生态协同。
• NIST的PQC标准化进程至关重要，但仅靠此尚不足够；还需更广泛的科研与工程努力以支持实际迁移。
• 产业实践者在测试、验证与将PQC算法集成到生产系统时面临重大障碍，主要因缺乏工具支持与规格说明不清晰。
• 亟需发展一门新研究领域——“密码灵活性”——以形式化并系统化大规模密码迁移的管理。