Nostr notes by Marin Ivezic

NIST published the final version of IR 8547, its plan for ...

2026-10-28T05:58:22Z

NIST published the final version of IR 8547, its plan for retiring quantum-vulnerable public-key cryptography, on October 27.

NIST deprecates RSA and ECDSA signatures at 112 bits or more, EdDSA at 128 bits or more, and DH, MQV and RSA key establishment at 112 bits or more, all after 2030. All of them are disallowed under NIST standards and guidelines after 2035.

P-256, P-384, RSA-3072 and Ed25519 had no deprecation step in the November 2024 draft and are now deprecated on the same day as RSA-2048.

A deprecated algorithm is usable, with a risk the data owner must examine before deciding to continue. A disallowed one is no longer allowed for the stated purpose. Decrypting old ciphertext and verifying old signatures fall under a third status, legacy use. NIST doesn't say how long it will last for these algorithms.

From 2031, anyone following NIST's statuses needs a recorded risk decision for each classical-only key exchange or signature they keep.

For hybrid key establishment, the SP 800-56C composite technique stays allowed even with a disallowed input, and a combination with at least one approved input can be FIPS 140-validated. Under SP 800-56C Rev. 2, a hybrid secret Z || T qualifies for approved key derivation when Z comes from an approved scheme. An ML-KEM secret counts.

The IETF put ML-KEM first in X25519MLKEM768, so the ML-KEM implementation is the component that must be validated. In SecP256r1MLKEM768 and SecP384r1MLKEM1024, the ECDH secret comes first. In SP 800-227, NIST already approves combiners with the approved secret in any position, but in IR 8547 it ties the either-order rule to a promised SP 800-56C update. Vendors shipping those groups should ask their labs how they'll be treated after 2035.

I'd keep the TLS combiner inside TLS. In SP 800-227 section 4.6.3, NIST says a combiner that uses only the shared secrets doesn't, in general, preserve IND-CCA security when only one component remains secure. The security analysis in RFC 10024 relies on the TLS 1.3 transcript.

The X25519MLKEM768 key share adds about 1.2 KB, so the ClientHello can span two packets, and some servers reject it instead of falling back to classical key exchange. Log the negotiated group for each production connection, and check every hop separately.

Hybrid key exchange protects session keys only, so the RSA or ECDSA chain needs its own migration. An ML-DSA-44 signature is 2,420 bytes, against 64 to 72 for ECDSA on P-256.

NIST gives key establishment and signatures the same dates in Tables 2 and 4. In the same report, it explains that harvest now, decrypt later makes key establishment more urgent.

In Section 3.1.2, NIST still says authentication may stay classical until a CRQC is available and then switch immediately. Under Table 2, the same algorithms are disallowed after 2035 either way.

Dual signatures get a definition but no encoding and no post-2035 status. Contracts and archives that must stay verifiable for decades need evidence records renewed with post-quantum algorithms, but NIST doesn't mention them in IR 8547.

HQC is the alternative KEM, with a FIPS in development. ML-KEM-768 is the default parameter set. LMS and XMSS are named for software and firmware signing.

NIST added Ascon to the symmetric tables and printed its AEAD entry as "AES-AEAD128" by mistake. It also corrected SHAKE256's preimage strength from 512 to 256 bits. The statuses that module validation applies come from SP 800-131A, and its Revision 3 is still a draft.

Full analysis, with a draft-to-final comparison table: https://postquantum.com/security-pqc/nist-ir-8547-final/

I teach the US requirements behind these dates in PQC Compliance: United States at Quantum Academy: https://quantumacademy.com/courses/pqc-compliance-us/

#infosec #cryptography #PQC #postquantum #NIST #TLS #FIPS

With the new hack-back memo, the US has shot itself in the foot ...

2026-08-14T16:48:08Z

With the new hack-back memo, the US has shot itself in the foot again. And most of the initial online discussions miss how far the damage reaches. For the US.

Quick summary. On August 12 the President signed a memorandum letting vetted American companies break into foreign systems used by criminal groups and disrupt or destroy them. It is not vigilantism: the companies act under federal direction, and two officials approve every operation in writing.

Americans lost more than $20 billion to this fraud last year, so the motivation is real. I am not against acting. I am against this approach, and I know the arguments because I spent years making them to governments that wanted the same thing.

The debate so far has been about whether private firms should do this, and whether innocent foreigners get hurt. However I analyze it, the first casualty is American:

- Why would anyone share threat intel with Americans, when it could now be used to attack infrastructure in their own country?

- Why would a non-US CISO keep American EDR and XDR agents deep in their stack, when nobody can tell them whether that vendor also runs surveillance and offensive operations for the state?

- Why would anyone outside the US let an American vendor build the map of their weakest cryptography, in the PQC discovery and inventory work their own regulator is forcing them to do?

- Why would a European buyer accept "we cannot comment" as a tender answer?

- Why would an American firm disclose the flaw it just found, when its other contract values that flaw unpatched?

- Why would a sovereign wealth fund hold a listed US security vendor it has no way to assess?

- Why would an allied service share access with a partner whose contractors may be on the same box?

- How does a US prosecutor explain the next indictment of a Chinese contractor hacker?

- What does Washington say when Beijing runs the same program and calls it law enforcement?

Procedures are due October 11 and need not be published. Which means these questions may never get a public answer, and every one of them will get answered by assumption instead. None of those assumptions will favor the American cybersecurity industry.

https://postquantum.com/cyber-kinetic-security/cyber-privateers-what-breaks/

#Cybersecurity #CISO #CyberPolicy #ThreatIntel #NationalSecurity #InfoSec #VendorRisk #PQC

Fair question, and you're right that Internet-facing OT and ...

2026-07-19T15:25:13Z

In reply to nevent1q…890c
_________________________

Fair question, and you're right that Internet-facing OT and medical devices have more urgent problems than PQC. Fixing basic exposure is a prerequisite to worrying about PQC.

But measuring PQC readiness by device type is how you find out which vendors and device categories will be the last-mile problem when regulatory deadlines (CNSA 2.0 2030, NIST deprecation 2030, UK NCSC 2028/2031/2035) become an issue.

Internet-wide PQC measurement: 160M SSH hosts scanned. IT: 12% ...

2026-07-18T18:49:00Z

Internet-wide PQC measurement: 160M SSH hosts scanned.

IT: 12% PQC-capable. OT: under 5%. Medical devices: under 5%. Cloud leads because providers deploy PQC by default. Everything else waits for manual upgrades nobody has scheduled.

The OT gap should alarm anyone in ICS/SCADA.

https://postquantum.com/security-pqc/forescout-pqc-adoption-data-2026/

#PQC #OTsecurity #ICS #infosec

After the White House quantum summit, I tested the claim that ...

2026-07-15T17:29:05Z

After the White House quantum summit, I tested the claim that America built "every layer of the quantum stack." Eight layers. Named researchers. Primary sources.

Quick scorecard:

The PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) that NIST standardized and that EO 14412 mandates for federal systems? Designed almost entirely by Europeans and Canadians. CWI (Netherlands), Bochum (Germany), IBM Zurich (Switzerland), ENS Lyon (France), Waterloo (Canada). NIST ran the process — that's a real institutional win. But the algorithmic content is international.

The enabling infrastructure is even more striking.

Dilution refrigerators from Finland (Bluefors) and UK (Oxford Instruments) dominate the market that cools US superconducting quantum computers. Domestic manufacturing exists (Maybell in Denver, Bluefors's Syracuse operation) but the US remains substantially dependent on European-headquartered suppliers.

Control electronics from Switzerland (Zurich Instruments), Israel (Quantum Machines), Germany (Rohde & Schwarz).

The CHIPS Act quantum investments are partly a response to these dependencies.

On the science side: Josephson junction predicted at Cambridge (1962). First superconducting qubit demonstrated at NEC Japan (1999). Surface code traces to Kitaev (Russia). Steane code from Oxford. qLDPC codes from French and Russian mathematicians.

The US built the strongest commercial integration and scaling layer. That is a real and hard-won capability. It is not the same as sole authorship of the entire stack.

Policy implication: "we built everything" leads to different supply chain decisions than "we built the best integration layer, and it depends on allied supply chains." The second framing is more accurate and produces better policy.

Full article with every claim sourced:
https://postquantum.com/quantum-sovereignty/who-built-the-quantum-stack/

#quantum #PQC #infosec #cryptography #postquantum #supplysecurity #quantumcomputing #cybersecurity