In October 2024 the National Institute for Standards and Technology (Nist) published a first public draft of Special publication 800 – 131awith the title “Transition of the use of cryptographic algorithms and key lengths”.
It is described how the nest expects the demands on the use of cryptography in order to protect non -classified information on the development.
There are several important points, such as B. leaving ECB and SHA-1, but the most important thing that this article is examined are digital signatures.
Transition to the strength of 128-bit
The nest assumes that the 112-bit strength, which is considered for most applications today, will no longer be until the end of 2030.
This means that algorithms, functions and modes that offer these safety strength should no longer be used beyond this point to protect new information. They can also be used to check a digital signature or decipher information, but do not sign or encrypt data.
Until January 2031, NIST will expect companies that are affected by FEPS (Federal Information Processing Standard) to be transferred to at least 128 security bits. One of the algorithms that will be affected is RSA and especially RSA 2048. As can be seen in column 4 of Table 2 In Nist SP 800-57 (part 1)RSA with a 2048-bit module offers a safety strength of 112 bit. This will no longer be sufficient in 6 years.
Which way forward?
The first idea that comes to mind, which is next to, would be to switch to RSA 3072 bits, since the next line in the table indicates that a 3072-bit module provides a safety strength of 128 bits, which in many cases meets the FIPS standard fips standards in many cases.
One could argue that with increasing key sizes, asymmetrical cryptography on elliptical curves becomes more attractive, since the aspect of computing power becomes increasingly in its favor, so that it could be time to switch to ECDSA.
Both options correspond to the next FIPS standard, but also not the preferred choice of nist.
Post quantum cryptography
In the section with reading 1.2.3in which the recommended strategy of the nist contains to remove 112-bit security strength. It is clear that the nest was in the 128-bit strength, which nest now recommends a one-step migration to quantum-resistant digital signature schemes.
Since this means to adopt new digital signature standards that are very new and are not yet generally accepted for the implementations, the nist does not make this mandatory.
This is part of the Post quantum cryptography project The recently (in August 2024) published three new FIPS standards:
- FIPS 203 describes ML-KEM, the module lattice-based key capsule mechanism based on Crystals (Cryptographic suite for algebraic grids) – Kyber
- FIPS 204 Describes ML-DSA, the module lattice-based digital signature scheme based on Crystals – – Dilithium
- FIPS 205 describes SLH-DSA, the stateless hash-based digital signature scheme based on Sphncs+
The latter two are the quantum -resistant digital signature schemes that the nist recommends. A second round is currently in progress to select further signature schemes.
Immediate effects
The provisions of the standard in terms of digital signatures only come into force on January 1, 2031. Even then, compliance with this standard for a certain series of systems is only automatically mandatory.
However, this is a good indication of where the field of cryptography leads and in 2031 is not that far away. Although most cryptographic software can be updated from time to time and configured so that you either use longer module or different algorithms, there is a certain area in which this standard is immediately relevant, especially in the embedded world: implementations of safe boat.
In fact, Secure Boot is based on checking a digital signature on the various components of the starting chain. The initial review is necessarily carried out by unchangeable software, since the replacement of this software would affect the entire chain with malicious implementation. It is therefore not possible to update this software for the recommendations of the nist on existing devices.
On embedded systems, this is the provider’s Romcode, which checks the signature of the boot loader. You can z. B. the software that supports NXP, quote Have (High insurance boots). NXPS HABV4 supports RSA 3072 and RSA 4096 and should therefore not be dealt with with these new recommendations, but a secure boot implementation that only matches the current standard prevent RSA 2048 that its users want to sign after 2031 new updates if they want to stay fips compliant.
Reduction of partial effects
It is important what is outdated after 2030 is that generation From new RSA signatures below 128 bit security strength.
examination Such signatures are permitted Legacy. The Romcode, which checks the signature of the boot loader (generated before January 1, 2031), would therefore be allowed, but not signed a new bootloader update.
This means that manufacturers/users of devices with a Romcode, the RSA 3072 or more implemented before January 2031.
The operating system, which is the likelihood that you have to be updated regularly, can then be updated as normal, since the bootloader carries out the signature check of the operating system and supports non -specified safety strengths.
Diploma
The way to implement the new quantum -resistant cryptographic standards, although it will probably be challenging in the embedded world, will probably be challenging.
This applies in particular in the context of a secure boat, especially until the acceleration of the hardware is more ubiquitous for you.
The effects can be reduced from a fully updated system to a system whose operating system can be updated, but not by his boot loader by ensuring that the correct safety strength at the level of the boot loader is ensured before 2031.