Quantum-Resistant PKI Certificate Update via Algorithm-Agnostic Key Renewal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The advent of quantum computers threatens the security of existing cryptographic systems used in public-key infrastructures (PKIs) due to their ability to break current cryptographic algorithms, necessitating a transition to quantum-resistant algorithms, but these are still under development and lack standardization, requiring flexible and adaptable solutions.
Innovation Solution
A programmable electronic device executes quantum-resistant Post-Quantum Cryptography (PQC) algorithms to generate and update cryptographic key pairs and certificates within a PKI, using remote authentication and symmetric or asymmetric encryption schemes to ensure compatibility and flexibility without requiring the PKI to know the specific PQC algorithms used.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If quantum-resistant algorithms are implemented to ensure future security, then security against quantum computing threats is improved, but the complexity of the cryptographic system increases due to ongoing algorithm development and lack of standardization
Solution Approach 1:
The system separates the cryptographic algorithm implementation from the PKI infrastructure. A dedicated cryptographic module handles quantum-resistant algorithms independently, while the PKI manages certificates and keys. This segmentation allows the PKI to remain agnostic to specific algorithm choices, reducing overall system complexity while maintaining quantum resistance.
Solution Approach 2:
The patent introduces an intermediary cryptographic module that acts as a bridge between the PKI and quantum-resistant algorithms. This intermediary handles the complexity of PQC key generation and management, shielding the PKI from algorithm-specific details while enabling quantum-resistant security.
2Reliability
If quantum-resistant algorithms are adopted to protect against quantum threats, then long-term security is improved, but the adaptability of the PKI system decreases due to the need for standardized algorithms that are still under development
Solution Approach 1:
The PKI is designed to be universal and algorithm-agnostic, capable of working with multiple quantum-resistant algorithms through a standardized interface. The cryptographic module can be configured to support different PQC algorithms (e.g., lattice-based, hash-based) without requiring changes to the core PKI infrastructure, maintaining adaptability while ensuring quantum resistance.
Solution Approach 2:
The system implements dynamic algorithm selection and updates. The cryptographic module can adapt to different quantum-resistant algorithms as they mature and become standardized, allowing the PKI to evolve with advancing cryptographic research while maintaining security against quantum threats.
3Reliability
If quantum-resistant key pairs are generated to ensure future-proof security, then security against quantum attacks is improved, but the computational overhead and key size increase
Solution Approach 1:
The computationally intensive quantum-resistant key generation and cryptographic operations are extracted to dedicated hardware modules or optimized software libraries. This separation allows the main PKI system to operate with standard efficiency while specialized components handle the heavier computational load of PQC operations.
Data Source
Figure 1~3
Figure 4
AI summary
A method is proposed for updating, in a public-key infrastructure (PKI), a cryptographic key pair and a certificate for the public key of the key pair, the key pair and the respective certificate associated with a certificate authority. According to such method, a programmable electronic device executes: - receiving, from the PKI, the certificate; - generating a quantum-resistant key pair and an updated certificate for the public key of the quantum-resistant key pair; and - transmitting, to the PKI, the quantum-resistant key pair and the updated certificate.