IBM takes the lead in post-quantum code competition

On July 27, IBM announced that it has adopted the National Institute of Standards and Technology (NIST) recommended post-quantum cryptography standard algorithm for real business [1]. With the IBM z16 mainframe, application developers can implement a dual-signature scheme and guarantee the future integrity of critical documents using the NIST choice for a standardized, lattice-based encryption algorithm, CRYSTALS-Dilithium.

01IBM is involved in the development of three NIST-recommended algorithms

Quantum computers will be very powerful: they will even make traditional cryptography exposed in seconds. To compromise data and provide data security, NIST launched the Post-Quantum Cryptography Project in 2017 - to develop ciphers that can be used with classical computers and withstand decryption by quantum computers. In July, NIST announced the selection of four algorithms as standards, which are expected to be completed in about two years.

These algorithms are designed for the two main tasks of public-key ciphers - public-key encapsulation (for public-key encryption, key establishment) and digital signatures (for authentication and nonrepudiation).

(a) For public key encryption and key establishment, the key encapsulation mechanism (KEM) chosen by NIST is the CRYSTALS-Kyber algorithm - which is also the primary algorithm in the KEM category.

For digital signatures, NIST has chosen three algorithms: CRYSTALS-Dilithium, Falcon, and SPHINCS+. CRYSTALS-Dilithium is the primary algorithm in the signature category.

The announcement marks an important milestone in the field of data security, as IBM revealed that it has been involved "with partners from industry and academia" in the development of three of the four algorithms selected by NIST: CRYSTALS-Kyber, CRYSTALS-Dilithium, and Falcon. Dilithium, and Falcon [2].

02What is a digital signature?

Signatures can take many forms, from a wax seal on an envelope to an autograph on a souvenir. Electronic signatures use a computer to verify the identity of the signer and certify the integrity of the document, and in most countries, they are as legally binding as handwritten-based signatures. Laws such as the Electronic Signatures Act and the Uniform Electronic Transactions Act (UETA) in the United States, and the Electronic Identification and Trust Services Regulation (eIDAS) in Europe have designated electronic signatures as legal, trustworthy and enforceable documents.

The significance of digital signatures goes far beyond what is imagined. A digital signature is an electronic signature with advanced features that uses cryptography to make it compliant and secure. At a high level, when creating a digital signature, the sender first generates a public-private key pair and shares the public key with others. The public and private keys are different, but mathematically related. Then, the sender uses the private key to generate a digital signature for the message. When the recipient receives the message and the digital signature, the recipient uses the sender's public key to verify the sender's signature to verify the integrity of the message. Because the signature relies on the sender's private key, only the sender can create this digital signature. The verification of the digital signature can be done by anyone because the sender's public key is used for verification and it is not a secret.

During the New Crown pandemic, the possibility of using pen and paper for signatures became almost impossible as countries around the world went into lockdown. This "pandemic" has driven the use of digital technologies such as electronic signatures, enhanced authentication and smart digital forms to facilitate the growth of digital government and business. Digital signatures have become the new normal, and the rate of adoption is unlikely to slow. According to a recent report by Markets and Markets [3], the global market for digital signatures is expected to grow at a compound annual growth rate (CAGR) of more than 33%: from $4 billion in 2021 to $16.8 billion in 2026.

Attractive global market potential for digital signatures

Digital signatures offer many advantages over handwritten signatures when it comes to efficient workflows because they use sophisticated algorithms, Certificate Authorities (CAs) and Trust Service Providers (TSPs). However, one consideration for digital signatures is that they rely on a public key cryptographic infrastructure (PKI), and if any weaknesses are found in this infrastructure, digital signatures will become invalid.