Shawn Geddis

— On the schedule —

Is the current cryptography testing and validation pipeline process capable of handling the impending Tsunami?

The cryptographic community has been abuzz for a decade about everyone needing to be ready for Post Quantum Cryptography. In April 2016, NIST published NISTIR 8105, "Report on Post-Quantum Cryptography", a technical report assessing the threat that quantum computers pose to existing public-key cryptographic systems. The real question we should be asking ourselves by now “Is the current cryptography testing and validation pipeline capable of handling the impending Tsunami”? The Cryptographic Module Validation Program (CMVP) pipeline for FIPS 140-3 validations, at one time, reached a staggering 720+ days, from initial start of testing to certificate issuance. There have been hundreds of modules in each of the queues waiting to move to the next queue in the pipeline. With an incredibly long validation process, increased pressure from the White House, and the threat of large-scale quantum computers in the hands of adversaries, the only prognosis seems to be complete collapse! There has to be a better way.