U.S. National Security Agency (NSA) Releases FAQ Document Discouraging the Use of QKD

The NSA has released an FAQ document that answers questions related to quantum computing and post-quantum cryptography. In particular it contains advice for users of National Security Systems (NSS) that communicate classified or otherwise sensitive military or intelligence information which use public key cryptography as a critical component to protect the confidentiality, integrity, and authenticity of national security information. The FAQ document contains their recommendations for the Commercial National Security Algorithm Suite (CNSA) for which algorithms these users should use in different applications. They indicated that the CNSA suite will be updated to include appropriate Post Quantum Cryptography (PQC) algorithms after NIST completes their selections in Round 3 of the PQC effort. The document also covers Quantum Key Distribution (QKD) technology and includes a recommendation that NSS owners should not be using or researching QKD technology without direct consultation with the NSA. The concerns expressed about QKD include that there are currently no security proofs for actual QKD hardware/software implementations, there is no standard methodology to test QKD hardware, and no currently established interoperability, implementation, or certification standards for these devices. They conclude by saying that NSA does not consider QKD a practical security solution for protecting national security information. The document also covers quantum random number generators (QRNG) and suggests that non-quantum random number generators are also acceptable as long as these devices have been appropriately validated or certified as acceptable for use in NSS or other government applications. You can view the FAQ document on Quantum Computing and Post-Quantum Cryptography here and another post that provides more about their views on QKD here.

August 30, 2021