Hart Montgomery, Executive Director, Post-Quantum Cryptography Alliance
A couple of months ago, the National Institute of Standards and Technology (NIST) released the first final standards for post-quantum cryptography, which were based on algorithms derived from Kyber, Dilithium, and SPHINCS+. While this was certainly a big milestone for NIST and for the overall post-quantum cryptography community, you probably haven’t heard too much coming from us at the PQCA. This is not unintentional; we believe that this is just “the end of the beginning,” as Dustin Moody of NIST put it, and thus time to continue ramping up our efforts, rather than something we should sit back and celebrate.
The genesis of the PQCA was the contribution of the Open Quantum Safe (OQS) project, which was founded by Douglas Stebila and Michele Mosca at the University of Waterloo. OQS dates back to 2016, which was not long after the NIST competition for post-quantum cryptography standards was launched (in February 2016, at the PQC 2016 conference). At the time, OQS was mostly an academic exercise, launched by two outstanding researchers–Douglas and Michele–as a way to test and analyze the PQC candidates.
Since then, the OQS project has grown into one of the most well-known libraries for post-quantum cryptographic implementations. It has picked up more contributors from both industry and academia, as well as important independent contributors. The stated goal of the project maintainers is to both move towards becoming a rock-solid, production-ready codebase while still allowing room for research and testing new ideas in post-quantum cryptography. The former goal was one of the primary reasons the OQS leaders decided to move the codebase to the Linux Foundation, where the maintainers and contributors could leverage the experience of the LF in building secure production code. To address research, the PQCA project lifecycle policy was explicitly designed to support research implementations as well as production code, and we have both research tracks and production tracks for codebases. This dual-track approach will let OQS and its contributors to be able to continue to be leaders in research as well as move towards ironclad production code.
There have been many exciting updates to the OQS project recently, most of which are focused on the NIST standards. For instance, the OQS team has just cut the liboqs 0.11 release containing ML-KEM, NIST’s post-quantum standard for public key encryption and key exchange. The OQS Provider for OpenSSL 3 enables use of PQC algorithms from liboqs, such as ML-KEM, in applications that use OpenSSL for TLS, X.509 certificates, and more. Please check the OQS GitHub to get a good indication of what the OQS community is currently focusing on building, and to contribute to moving OQS forward.
While OQS was the impetus for and still is the most popular project in the PQCA, it is not the only top-level project. This year, a group of cryptographers and cryptographic engineers joined together to start the PQ Code Package project, which is focused on extremely hardened, high-quality, and formally verified implementations of post-quantum cryptographic standards. While the PQ Code Package is certainly a work in progress, we see a lot of exciting work there happening in the future.
For more information about PQCA’s ongoing efforts to support the development and adoption of post-quantum cryptography, please visit https://pqca.org.
About PQCA
Public key cryptography is essential in securing all Internet communications. The mission of the Post-Quantum Cryptography Association (PQCA) is to advance the adoption of post-quantum cryptography, by producing high-assurance software implementations of standardized algorithms, and supporting the continued development and standardization of new post-quantum algorithms with software for evaluation and prototyping.
Sign up for the PQCA’s Mailing List.
Follow the work on GitHub.
Connect with on Discord.
Attend a community Meeting.
Join us as a Member.