Public Key Infrastructure (PKI) continues to play a crucial role in securing government networks and providing cryptographic assurance of a person or device’s identity. Its strength depends on using a mathematically related public and private key, where the public key is intentionally shared, and the private key is controlled by an end entity to prove its identity. Quantum computers pose a risk to this paradigm, as they can perform mathematical operations much faster than classical computers. This could allow for quantum computers to derive an entity’s private key from their public key and perform operations while impersonating that entity. This report examines the role of PKI systems in the federal government of the United States (US), commonly used cryptographic algorithms throughout the US government, and how those algorithms could be made vulnerable to exploitation by the advancement of quantum computers. A comparison of the performance differences between Rivest-Shamir-Adleman (RSA), a cryptographic algorithm commonly utilized by Federal PKI systems, and the Post-Quantum Resistant (PQR) digital signature algorithm, CRYSTALS-Dilithium, is also provided. The report concludes with an analysis of the performance of PQR algorithms and considerations that federal agencies will need to make when implementing PKI systems that utilize PQR algorithms.
Public Key Infrastructure (PKI) continues to play a crucial role in securing government networks and providing cryptographic assurance of a person or device’s identity. Its strength depends on using a mathematically related public and private key, where the public key is intentionally shared, and the private key is controlled by an end entity to prove its identity. Quantum computers pose a risk to this paradigm, as they can perform mathematical operations much faster than classical computers. This could allow for quantum computers to derive an entity’s private key from their public key and perform operations while impersonating that entity. This report examines the role of PKI systems in the federal government of the United States (US), commonly used cryptographic algorithms throughout the US government, and how those algorithms could be made vulnerable to exploitation by the advancement of quantum computers. A comparison of the performance differences between Rivest-Shamir-Adleman (RSA), a cryptographic algorithm commonly utilized by Federal PKI systems, and the Post-Quantum Resistant (PQR) digital signature algorithm, CRYSTALS-Dilithium, is also provided. The report concludes with an analysis of the performance of PQR algorithms and considerations that federal agencies will need to make when implementing PKI systems that utilize PQR algorithms.
Development of Quantum Computers are growing rapidly, the security of today’s cryptographic systems which are working with Public Key Infrastructure (PKI) is at serious risk. RSA and ECC algorithms are the backbone of secure communication and digital identity can be breakable by quantum algorithms such as Shor’s. Hence, a transition is required to Post-Quantum Cryptography (PQC), which is designed to handle quantum attacks. This work provides a detailed review of how PQC can be integrated with the existing PKI, with a special focus on the auto-enrollment process. Auto-enrollment is an essential process but often overlooked mechanism, responsible for automatically issuing and renewing digital certificates. First, we explored how current PKI systems are exposed to the quantum threats and the readiness. The performance of the algorithms that are standardized by NIST, such as Kyber and Dilithium were discussed. We analyze the technical and operational challenges of transitioning to PQC by referencing both research studies and real-world implementations from major industry players such as Google and Microsoft. These include large key size, certificate size, compatibility issues, complex computations and need for crypto-agility. We also examine the hybrid approaches that combine classical and post-quantum methods as traditional strategies. The survey concludes by outlining best practices, deployment considerations, and open research challenges that must be addressed for a smooth, secure, and scalable shift to quantum-safe PKI. This work aims to guide researchers, engineers, and policymakers in building the next generation of cryptographic infrastructure that can stand the test-time even in a quantum world.
Public Key Infrastructure (PKI) generates and distributes digital certificates to provide the root of trust for securing digital networking systems. To continue securing digital networking in the quantum era, PKI should transition to use quantum-resistant cryptographic algorithms. The cryptography community is developing quantum-resistant primitives/algorithms, studying, and analyzing them for cryptanalysis and improvements. National Institute of Standards and Technology (NIST) selected finalist algorithms for the post-quantum digital signature cipher standardization, which are Dilithium, Falcon, and Rainbow. We study and analyze the feasibility and the processing performance of these algorithms in memory/size and time/speed when used for PKI, including the key generation from the PKI end entities (e.g., a HTTPS/TLS server), the signing, and the certificate generation by the certificate authority within the PKI. The transition to post-quantum from the classical ciphers incur changes in the parameters in the PKI, for example, Rainbow I significantly increases the certificate size by 163 times when compared with RSA 3072. Nevertheless, we learn that the current X.509 supports the NIST post-quantum digital signature ciphers and that the ciphers can be modularly adapted for PKI. According to our empirical implementations-based study, the post-quantum ciphers can increase the certificate verification time cost compared to the current classical cipher and therefore the verification overheads require careful considerations when using the post-quantum-cipher-based certificates.
The emergence of quantum computing introduces unprecedented risks to classical cryptographic schemes, particularly digital signatures that safeguard authentication, confidentiality, and data integrity across digital ecosystems. To address these concerns, this paper investigates the adoption of Post-Quantum Cryptography (PQC) within Public Key Infrastructure (PKI) frameworks, emphasizing its role in strengthening electronic signature (eSign) systems against quantum threats. Traditional PKI implementations rely on algorithms such as RSA and ECC in combination with Hardware Security Modules (HSMs) for secure key management; however, these methods are vulnerable to quantum algorithms like Shor's. We examine how quantum-resistant alternatives-including lattice-based, hash-based, and multivariate polynomial-based schemes standardized by NIST-can be integrated into PKI without compromising interoperability and compliance. A comparative evaluation highlights trade-offs in performance, storage, and computational complexity while demonstrating the feasibility of embedding PQC into existing eSign infrastructures. Our findings underscore the urgency of transitioning towards quantum-safe digital signatures to ensure resilience, regulatory alignment, and long-term trust in national-scale digital services.
Public Key Infrastructures (PKIs) provide digital public services and communication by securing information-sharing and strong credentials for digital identity management to individuals, businesses, and government agencies. While cryptographic algorithms that current PKI systems depend on are mostly resilient against hacks and other threats launched from computers we use today, the advancement of quantum computing technology introduces new security threats. This calls for current PKI systems to be modified with quantum-safe cryptographic algorithms. However, transitioning to Quantum-safe (QS) PKI systems remains complex, and the challenges are socio-technical. The research aims to guide organizations transitioning towards QS PKI systems. In doing so, we will deconstruct the QS transition into a series of stages and paths using growth models and examine how organizations can transit over time towards QS PKI systems.
Recently, there has been an increasing focus on the investigation of quantum-safe solutions for a variety of applications. One of the pressing issues that needs to be made quantum secure is the TLS (Transport Layer Security) protocol. Proposals for its implementation have been discussed in several articles. The TLS protocol is based on PKI (Public Key Infrastructure). In addition, there are many other PKI applications that are used every day in both private and enterprise environments, so securing their use is essential. The methods currently developed to ensure adequate security will become obsolete with the advent of quantum computers. According to the Cloud Security Alliance, by around 2030, the performance of quantum computers will increase to the point where the risk of vulnerability of traditionally encrypted data will be very high. It is therefore important to make the right preparations in time to ensure that we can transform our solutions into quantum secure solutions by the time quantum computing becomes a real threat. In this paper, we present an analysis to this end, presenting quantum-safe solutions already in use and, in comparison, proposing new, well-performing solutions for a quantum-resistant PKI.
As quantum computing advances, current cryptographic protocols are increasingly vulnerable to quantum attacks, particularly those based on Public Key Infrastructure (PKI) like RSA or Elliptic Curve Cryptography (ECC). This paper presents a comprehensive review of Post-Quantum Cryptography (PQC) as a solution to protect digital systems in the quantum era. We provide an in-depth analysis of various quantum-resistant cryptographic algorithms, including lattice-based, code-based, hash-based, isogeny-based, and multivariate approaches. The review highlights the National Institute of Standards and Technology (NIST) PQC standardization process, highlighting key algorithms, such as CRYSTALS–Kyber, CRYSTALS–Dilithium, Falcon, and SPHINCS+, and discusses the strengths, vulnerabilities, and implementation challenges of the leading algorithms. In addition, we explore transition strategies for organizations, emphasizing hybrid cryptography to ensure backward compatibility during migration. This study offers key insights into the future of cryptographic standards and the critical steps necessary to prepare for the transition from classical to quantum-resistant systems.