U.S. federal agencies required to submit priority list of encryption systems by May 4

On February 16, the Office of the National Cyber Director (ONCD) at the White House has issued specific instructions to federal agencies on inventorying their cryptographic systems to help agencies better transition to the era of quantum-resistant cryptography.

ONCD's guidelines will help guide federal agencies in inventorying their most critical cryptographic systems by May 4, as Dylan Presman, director of budget and evaluation for the office, explained in ATARC's Quantum Speaker Series, "Today, ONCD issued guidance and templates to federal departments and agencies on an inventory of cryptographic systems, and departments and agencies are responsible for submitting a prioritized list of encryption systems to the executive branch by May 4."

The NSM-10 Act [1], which aims to promote U.S. leadership in quantum computing while mitigating the risks to already existing cryptographic systems, was issued by the Biden Administration last May. The memo outlines the threats posed by the prospect of quantum computers related to cryptanalysis and asks agencies to prepare now for the transition to quantum-resistant cryptography.

The White House warns that once operational, quantum computers are expected to be able to disrupt certain widely used encryption algorithms that PQC will use to protect federal data and information systems.

In addition, and most importantly, agencies must be aware that encrypted data can be recorded now and then decrypted by future operators of quantum computers.

"Quantum computers will be mature enough in 20 to 30 years," Presman explained, "but it's not just about when the quantum computer is ready, it's about the shelf life of the data." Presman warned [2] that classified and sensitive data (such as medical records, intellectual property or witness names) - which could have a lifespan of 25 to 50 years or more - is critical for the U.S. government to continue to protect this information.

White House officials warned, "Time is running out on building systems to protect our classic computers. We know that foreign adversaries are currently collecting encrypted data from public and private entities and plan to decrypt it later when sufficiently advanced quantum computers become available."

The White House Office of Management and Budget (OMB) issued M-23-02: "Migrating to Quantum-Resistant Cryptography" in November 2022, informing agencies of the upcoming transition to quantum-resistant systems requirements and telling leadership to expect specific instructions from ONCD to be released in mid-February.

Reference links:

[1]https://www.meritalk.com/articles/omb-establishes-deadline-for-government-departments-to-provide-quantum-vulnerable-cryptographic-systems/

[2]https://www.meritalk.com/articles/oncd-gives-agencies-guidance-for-quantum-resistant-work/