Show Notes
YouTube: https://youtu.be/hcdk3u2R5Mo Yesterday, I gave two short presentations on PQC (Post Quantum Cryptography), and next week, I'm in London to give a more focused talk on the subject. And so, it's great to see that Samsung is driving forward the adoption of PQC methods in their new S25 smartphone. There are two companies that have a core focus on creating trusted hardware for consumers: Apple and Samsung. Apple has always had a core focus on making sure they use the best cryptography to not only secure their devices but also to make them privacy-aware. Samsung, too, has strived for improved security but, at times, has made a few slip-ups along the way, but always patched around them. Now, Samsung Electronics has integrated PQC into their Galaxy S25 series of devices. The need for this is that NIST will deprecate all our existing public key methods in 2030, including: RSA for public key encryption; RSA, ECDSA and EdDSA for signatures; and ECDH for key exchange. NIST will then remove them in 2035 from the NIST FIPS 140 standard. Given that a smartphone will have a life of at least five years, it makes sense to build the hardware to support the migration. Along with this, we see the rise of "harvest now, decrypt later" threats, where network traffic could be captured now and then decrypted sometime in the future. The main integration at the current time involved ML-KEM (FIPS 203, aka Kyber) and ML-DSA (FIPS 204, aka Dilithium). With ML-KEM we replace key exchange and public key encryption methods, while ML-DSA provides us with digital signing:
These methods will be the Samsung Knox Matrix for enhanced data protection — this includes end-to-encryption for back-ups and the recovery of data from the Samsung Cloud. Overall, Samsung devices, like Apple hardware, have a secure enclave to store private and secret keys, and where not even Samsung can get access to them. The usage of PQC will mean that Samsung devices will be able to communicate with other devices in the future and which are using PQC methods. This ensures not only current compatibility but also future compatibility. An important advancement of the industry is that Samsung will support PQC methods for their backup system to their Cloud. Conclusions Of course, the integration will not force applications and services to use PQC, and in most cases, it will still use our traditional methods, as devices that it connects to must support PQC. Thus, we will see a migration towards PQC, rather than a hard switch-over. In cryptography, this is often the case, as we can typically negotiate the cryptography methods that are used in the secure transmission or storage of data. Once all the required services and applications support PQC, our existing public key methods will likely be switched off.
More from ASecuritySite Podcast
Yael is the Ellen Shallow Richards Professor at MIT. She was previously a Senior Principal Researcher at Microsoft Research. At the Weizmann Institute of Science, Yael worked with Adi Shamir and completed her PhD advised by Shafi Goldwasser at MIT in 2006. She was elected as a Fellow of the IACR in 2022 for foundational contributions in delegated computation and leakage-resilient cryptography, and service to the cryptographic community. She received the ACM Prize in Computing in 2022 for breakthroughs in verifiable delegation of computation and fundamental contributions to cryptography. Yael was a co-inventor of ring signatures, and has also shown the insecurity within the Fiat-Shamir heuristic. Along with Ron Rivest, and Adi Shamir, she published the classic paper of "How to leak a secret".
Claude is a professor at the École de Technologie Supérieure and obtained his Ph.D. in Computer Science from MIT in 1990, working in the field of cryptography with Silvio Micali as his Ph.D. advisor and with Gilles Brassard as his MSc advisor. Claude was a member of the Canadian Institute for Advanced Research program on Quantum Information Processing from 2002 to 2012 and is best known for his fundamental work in zero-knowledge proof, multi-party computing, quantum cryptography, and quantum teleportation. In 1993, along with Charles H. Bennett, Gilles Brassard, and others, Claude invented quantum teleportation. His 1988 STOC paper with David Chaum and Ivan Damgård on secure multi-party computation received the ACM STOC 30-year Test of Time Award in 2021. In 2013, he was elected as a Fellow of the IACR.
Yevgeniy is a Fellow of the IACR (International Association for Cryptologic Research), and a Professor of Computer Science at New York University. He has worked in a variety of areas, including secure messaging and end-to-end security, random number generation, LLM watermarking, cryptography with biometrics and other noisy data, hash function and block cipher design, protocol composition and information-theoretic cryptography. Some of his work on Random Number Generation, Hash Functions and Secure Messaging has had real-world impact (e.g., for Zoom, Microsoft, Apple and Signal, among others). In addition to being an IACR Fellow, Yevgeniy was the recipient of 2021 and 2019 IACR Test-of-Time Awards for his work on Fuzzy Extractors and Verifiable Random Functions. He has also won the National Science Foundation CAREER Award, Faculty Awards from AWS, Facebook, Google, IBM, Algorand, Protocol Labs, JP Morgan, Stellar Foundation and VMware, and the Best Paper Award at the 2005 Public Key Cryptography Conference.
David is a cryptographer and a professor at the École normale supérieure. He was previously a professor at Panthéon-Assas University. David is well known for his work in public-key cryptography, especially around the cryptanalysis of digital signature schemes. He co-designed the Naccache-Stern cryptosystem and the Naccache-Stern knapsack cryptosystem. David is also a visiting professor and researcher at the Information Security Group of Royal Holloway, University of London, and in 2020, was elected as a Fellow of the IACR.
Paul is a cryptographer and computer security researcher, and is currently a professor of computer science at Carleton University in Ottawa, Ontario. He previously held a Canada Research Chair in authentication and computer security and is a Fellow of the Royal Society of Canada (FRSC). Along with Alfred Menezes and Scott Vanstone, Paul was a co-author of the Handbook of Applied Cryptography, and the author of Computer Security and the Internet. In 2000, he was awarded The J.W. Graham Medal in Computing Innovation, and a Fellow of the Association for Computing Machinery in 2016 for his "contributions to applied cryptography, authentication and computer security.