SIKE after the quantum code was broken follow-up NIST fourth round of screening may remove it

In July 2022, NIST was the first to announce the results of the third round of screening for its post-quantum cryptographic standardization project: CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and SPHINCS+ were selected and became standardized algorithms; at the same time, NIST also proposed four additional algorithms - -BIKE, Classic McEliece, HQC, and SIKE, to further explore whether to standardize them in the hope that one or more of these algorithms could also become suitable alternative encryption schemes in the post-quantum world.

However, in just one month, the post-quantum key exchange algorithm SIKE (Super Singular Homologous Key Encapsulation) has already been cracked twice, and in two different ways (the latter even achieved encryption cracking using only classical computers); this shows the risks involved in standardizing the next generation of encryption algorithms [1]. Recently, Dustin Moody, a mathematician at NIST and head of the Post Quantum Cryptography (PQC) project, publicly stated that it is "unlikely" that SIKE will survive the fourth round [2].

Dustin Moody

Moody spoke at the National Cybersecurity Center of Excellence (NCCoE) webinar, explaining what NIST learned from the rapid cracking of SIKE. "All of these cryptosystems, we invite people to look at them and start their attack cycle ...... This shows the value of evaluating and testing them. That's the kind of thing we want to see in this process."

However, he added, "On the other hand, while the fact that SIKE made it to round four means it passed three rounds and we are starting to have some confidence in it; however, one of the reasons NIST put it in round four instead of selecting it earlier or standardizing it is that the technology comes from a relatively new area of research and we feel it still needs more time. So in that sense, it's not surprising that this algorithm was cracked. It's a very good research result, but until these papers cracked it, we didn't see any flaws in the SIKE defense."

Echoing industry speculation, Moody also said it is "unlikely" that SIKE will survive Round 4, but there are no plans to add a new cryptographic candidate to replace it in Round 4.

"NIST is looking to open up the standardization process to new digital signature candidates, but any new entrants could face years of evaluation." Even encryption schemes and digital signature models that were standardized in July could still face two years of more rigorous evaluation, testing and even tweaking before being finalized in 2024. The urgency to upgrade to PQC is growing, but Moody stressed that organizations shouldn't go too far down that road. "We sincerely recommend not hard-coding (hard-code) them or using them until the standards are released; because the current version of the specification may continue to change slightly until the standards are released."

Moody suggests that the current focus should be on evaluating the encryption methods being used, as well as the number and type of devices and systems that will eventually need to be upgraded, and taking the time to carefully develop a PQC migration plan.

"We are currently drafting standards: documents are being written to tell the industry how to implement them; we expect the final version to be released by 2024. Until then, we will release versions for public comment so we can get feedback and suggestions and address any issues we need."

Finally, Moody said he will have more to say about SIKE in a presentation titled "The Future of PQC" at the IQT Quantum Cyber Security Event in New York City in late October.

Reference Links:

[1]https://arstechnica.com/information-technology/2022/08/sike-once-a-post-quantum-encryption-contender-is-koed-in-nist-smackdown/

[2]https://www.insidequantumtechnology.com/news-archive/moody-discrediting-of-sike-shows-pqc-evaluation-process-is-working/