Projecten

PQC benchmarking

Started in May 2024

The migration to quantum safe cryptography (PQC) will be a big undertaking for organisations. This fact, in combination with the many unknowns about the migration, can create a hesitance to start, eventually leading to increased risk.

This uncertainty is due to:

Lack of hands-on experience with PQC
The knowledge that the new algorithms are different in terms of functionality and performance
The fact that there is not one replacement, but multiple, with each their own drawbacks and multiple replacement options (hybrid or not).
Existing benchmarks have limited scope and often do not consider whole applications. There is not a lot of information on the migration process itself,

In this project, we aim to remove some of this uncertainty. How? By actually doing a migration

Project

We aim to provide information and experience on PQC migration, capturing both the process and technical impact.

How

Each of the participating partners will migrate one of their applications, testing multiple PQC schemes. We have picked applications common in organisations, that together will provide a nice intersection of the IT landscape. TNO and the other partners will support the migration process. The end result will consist of performance figures and information on the migration itself, topics like crypto agility (how did me manage that in practice), technical aspects (did we run into issues, did we need architectural changes) and general experiences (which people do you need for something like this, which pitfalls to avoid).

Impact for "the world"

Knowledge on the process and impact of PQC migration
Guidance on algorithm differences and migration options in practice
Pitfall and bottleneck information

Impact for participating partners

In-house, hands-on experience on doing a cryptographic migration.
A migration with relatively little pain due to support of the others.
Organisational knowledge on the migration. Where will the difficulty be for your organisation: management support? Vendor support? Technical expertise?
Knowledge, collaborations and connections. A lot of knowledge is gained on-the-fly, and the collaborations with vendors are very valuable.
Increased internal awareness. A project like this helps increase internal awareness. It also has a small scope, making it easier to get management buy-in, and it can be a stepping stone for the larger migration efforts.
Commercial show-off. Its result is a positive thing to show of internally, which helps motivate management to give PQC migration priority. Vendors are also more motivated to help due to the commercial benefits of showing that they already support PQC. Lastly, do not underestimate the bragging rights of "We already did a PQC migration".

Previous phases

After research into suitable use cases to migrate at the partners and the format of the project, we have now completed the first migration in the PoC. The gained experience helps in doing the pilot migrations more efficiently.

Activities in Pilot phase

We will migrate at least two applications of two partners (and more are being discussed).

The fictional image above is created with the use of Midjourney