[Debian-uk] Developer Authentication within Debian

[Andy Simpkins]

Hi all,

Over the past few years I have been suggesting that the approach of a 
functional Quantum Compute Machine will put our existing Asymmetric 
Security systems at risk of compromise.

I suggested at the Cambridge Miniconf 3 years ago that we had between 5 
and 10 years before a functional QC is able to compromise our existing PKI.

I am not a lone voice...  The USA has shortened it's timelines requiring 
General Encryption & Key Establishment to be implemented by Dec 31, 2030 
and Digital Signatures & Authentication be implemented no later than Dec 
31, 2031

Debian is not obliged to follow, but this is the point that governments 
are placing deadlines for deployment of PQC.  I would very much like 
Debian to have moved to 'a PQC' authentication system before our 
existing keys are considered 'at risk'

Can we have a discussion at the Miniconf on Friday afternoon to consider 
the possible options, and come to some kind of consensus (better yet a 
plan of works) to present to the wider project as a whole?


Thanks


/Andy



The /requirements/ from USA

  * In May 2022, President Joe Biden issued *National Security
    Memorandum 10 (NSM-10)*, which set a blanket target for federal
    civilian agencies to fully migrate systems to PQC by *2035*.
  * In 22 June 2026: Citing hardware breakthrough accelerations from
    major research entities, EO 14412 drastically moved the goalposts.
    It split the target into critical components and advanced the
    baseline by five years. Under this directive and the supporting *OMB
    Memorandum M-26-15*, the highest-priority targets—*High Value Assets
    (HVAs)* and *High Impact Systems (HIS)*—must secure their data
    transit encryption by *December 31, 2030*.


EO 14412 explicitly acknowledges that not all cryptography is equal, 
creating two phases

  * *Phase 1 (Key Establishment / Encryption):* Due *December 31, 2030*.
    This targets "Harvest Now, Decrypt Later" (HNDL) attacks to protect
    data today from future decryption - If I have understood correctly
    this is "Data In Flight"
  * *Phase 2 (Digital Signatures / Authentication):* Due *December 31,
    2031*. Recognising that upgrading identity management architectures
    is more technically complex, US agencies are granted an additional
    year to transition authentication mechanisms. This also

In addition, EO 14412, targets the supply chain by giving the *Federal 
Acquisition Regulatory (FAR) Council*direct mandates to enforce NIST 
Federal Information Processing Standards (FIPS) on covered federal 
information technology vendors. Tech providers must comply by the same 
2030 timeline, effectively pushing post-quantum mandates deeply into the 
commercial marketplace.


The National Institute of Standards and Technology (NIST) finalised its 
first primary standards for Post-Quantum Cryptography (PQC). These are 
the specific, officially approved algorithms mandated for deployment by 
Executive Order 14412:

1. General Encryption & Key Establishment (Mandated for Dec 31, 2030)

  * *ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)*
      o *Standard Name:* *FIPS 203*
      o *Original Project Name:* CRYSTALS-Kyber
      o *Purpose:* This is the *primary algorithm* for general
        encryption and secure key exchanges across the web (e.g.,
        establishing a secure connection when you visit a website). It
        is lattice-based, relying on the mathematical complexity of
        high-dimensional geometric grids.
      o *Backup Algorithm:* In March 2025, NIST also selected *HQC
        (Hamming Quasi-Cyclic)* as an alternative code-based backup
        encryption algorithm to step in if ML-KEM is ever compromised.

2. Digital Signatures & Authentication (Mandated for Dec 31, 2031)

  * *ML-DSA (Module-Lattice-Based Digital Signature Algorithm)*
      o *Standard Name:* *FIPS 204*
      o *Original Project Name:* CRYSTALS-Dilithium
      o *Purpose:* This is the *primary algorithm* chosen to protect
        digital signatures and establish identity verification. It
        ensures that documents, code updates, and software have not been
        tampered with by an attacker.
  * *SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)*
      o *Standard Name:* *FIPS 205*
      o *Original Project Name:* SPHINCS+
      o *Purpose:* This serves as a secondary, *highly secure backup
        standard* for digital signatures. Unlike ML-DSA, it is
        completely hash-based rather than lattice-based. It has larger
        signature sizes and is slower, but it relies on entirely
        different math—offering insurance if unexpected vulnerabilities
        are discovered in lattice math.
      o *Alternative Algorithm:* *FN-DSA* (formerly FALCON) is a
        smaller, more efficient lattice signature method that is
        currently undergoing final standardization (FIPS 206).


These standards are explicitly designed to completely phase out current 
widespread asymmetric public-key cryptography—including *RSA, 
Diffie-Hellman, and Elliptic Curve Cryptography (ECDSA/EdDSA)*



[1] National Institute of Standards and Technology, NIST
https://pages.nist.gov/nccoe-migration-post-quantum-cryptography/FAQ/index.html
[2]    National Coordinator for Critical Infrastructure Security and 
Resilience, CISA
         https://www.cisa.gov/topics/risk-management/quantum