Certification for Post-Quantum Cryptography gaining momentum

A crucial step in helping any new technology specification gain adoption is certification. NIST has been hard at work establishing more than post-quantum cryptography algorithms – they’ve also integrated the new algorithms into their process for third-party validation testing to ensure implementations are as advertised. Secure-IC is the first security IP and software vendor to achieve official worldwide NIST algorithm certification for post-quantum cryptography (PQC) software and secure element IP. Here’s a brief look at what NIST certification entails and what Secure-IC achieved.

An overview of NIST certification for crypto algorithms

NIST created its Cryptographic Algorithm Validation Program (CAVP) in 1995 to test FIPS-approved, NIST-recommended algorithms. Testing occurs on an Automated Cryptographic Validation Test System (ACVTS) with a NIST-controlled hardware environment. NIST offers a Demo ACVTS server as a sandbox environment and a Production ACVTS server accessible only by accredited third-party cryptographic and security testing (CTS) laboratories. Only tests by third-party CTS labs on the Production ACVTS server can advance as evidence for obtaining a CAVP certificate.

ACVTS spans capabilities for supported algorithms, including parameters such as message length, and automatically generates test cases and vectors for robust coverage. Vectors are suitable for feeding an implementation candidate, which can run its functions and provide outputs back to ACVTS. A correctness score for each algorithm in a test session returns. This approach keeps ACVTS testing as black-box – NIST never sees implementations as they are not uploaded to the ACVTS server, with only vectors sent and outputs returned.

NIST keeps the CAVP suite current, retiring outdated algorithms and incorporating new advancements as they become approved. CAVP online documentation contains a current list of algorithms and their specifications, validation testing requirements, validation lists, and test vectors.

Moving from PQC algorithms to crypto module certification

PQC algorithms are now part of the CAVP suite, and validation testing of PQC implementations can ensue. Since we last discussed PQC here, some of its algorithms received less informal, more technically accurate names from NIST. CRYSTALS-Kyber is now known as ML-KEM (module-lattice-based key-encapsulation mechanism), and CRYSTALS-Dilithium now goes by ML-DSA (module-lattice-based digital signature algorithm).

Secure-IC conferred with an in-country CTS-accredited lab, SERMA Safety and Security, to validate its Securyzr™neo-product for PQC. A summary of the algorithm tests appears in the NIST validation certificate, A6046, dated October 30, 2024. Secure-IC focuses on optimizing its implementations for fast throughput in SoC-optimized IP blocks ready for hardware design.

CAVP validation is crucial because compliance is ultimately a function of the complete system context for an implementation, as with many specifications. CAVP is a mandatory prerequisite for certifying a cryptographic module, a combination of hardware and software in an end product. NIST also shepherds a Cryptographic Module Validation Program (CMVP), transitioning from FIPS 140-2 compliance to FIPS 140-3, reflecting the recommendation for PQC implementations. A full FIPS 140-2 sunset date of September 2026 incentivizes module designers to get moving with their CMVP validation. Any system requiring cryptographic protection must conform to FIPS 140-3 requirements – with PQC incorporated – by that date.

Secure-IC is committed to helping its customers navigate these requirements and quickly bringing PQC into the mainstream. Their PQC-enabled solutions are configurable and scalable to meet a range of cryptography needs, with an eye on performance and power efficiency. Their achievement of certification for post-quantum cryptography algorithms puts their customers ahead in the race for protecting platforms from advanced cybersecurity threats. More information is available in a press release from Secure-IC, which includes more details on the Securyzr neo-product certification, links to the official NIST certificate, and background on the cooperation with SERMA Safety and Security.

Secure-IC obtains the first worldwide CAVP Certification of Post-Quantum Cryptography algorithms, tested by SERMA Safety & Security

Also Read:

Facing challenges of implementing Post-Quantum Cryptography

Secure-IC Presents AI-Powered Cybersecurity

How Secure-IC is Making the Cyber World a Safer Place