Skip to content

Initial proposal for compliance-themed entry #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rot169 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Initial proposal for compliance-themed entry #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions quantum-top-10/QSxx_Compliance-Obligations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
## Compliance Obligations

**Description:**

Regulatory, legislative and standards requirements mandate the migration to quantum-resistant cryptography. Organisations must meet such requirements regardless of the creation of a cryptographically-relevant quantum computer (CRQC) that can actually break classical crypto schemes.

**Common Examples of Vulnerability:**

1. NSM-10 requires US federal entities to migrate to quantum-resistant cryptography, with a target of "achieving as much migration as possible by 2035".
2. NIST has established timelines for depreciating and disallowing RSA, ECC and Diffie-Hellman. NIST standards are considered de-facto industry standards; in parallel, contractual and insurance terms often include a provision to adopt industry standards. Ergo failing to follow NIST standards could leave an organisation in breach of contractual or insurance terms.
3. Several EU laws reference the need to consider "state-of-the-art" security controls; quantum-resistant crypto meets that definition.

**How to Prevent:**

1. Understand the consequences of not migrating, or delaying migrating, by identifying any relevant legislation, regulatory requirements and contractual terms relating to cryptography.
2. Develop and execute a cryptographic migration that fulfils the requirements identified in #1.

**Example Attack Scenarios:**

Scenario #1: An organisation defers PQC-related activities in the belief that a CRQC is still many decades away, whilst failing to recognise the evolving compliance landscape. They discover during an audit several years later that their failure to migrate leaves them out-of-step with industry standards, and therefore in breach of contract with their clients. Clients are forced to move their business elsewhere due to their own 33rd-party commitments to their clients.

**Reference Links:**

1. [National Security Memorandum 10](https://www.presidency.ucsb.edu/documents/memorandum-promoting-united-states-leadership-quantum-computing-while-mitigating-risks): NSM-10 - Federal requirements for migrating to quantum-resistant cryptography
2. [NIST IR 8547](https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf): NIST proposals to depreciate & disallow RSA/ECC/DH