Post-Quantum Cryptography: Securing Research Data for the Next Century

The Quantum Threat to Research Data

Quantum computers capable of breaking current cryptographic standards are no longer science fiction. IBM, Google, and others have demonstrated quantum systems with increasing qubit counts, and experts estimate that cryptographically-relevant quantum computers (CRQCs) could emerge within 10-15 years.

For research data, this presents an existential threat:

• Harvest Now, Decrypt Later: Adversaries can store encrypted data today and decrypt it when quantum computers mature
• Long-Lived Data: Research data often needs protection for decades
• Sensitive Information: Medical, genetic, and national security research requires the highest protection

NIST Post-Quantum Standards

In 2024, NIST finalized the first post-quantum cryptographic standards after an 8-year evaluation process:

ML-KEM (CRYSTALS-Kyber) - Key Encapsulation

• Security Basis: Module Learning With Errors (MLWE)
• Key Sizes: 800-1568 bytes (vs 32 bytes for X25519)
• Performance: ~10x slower than classical, but still practical

ML-DSA (CRYSTALS-Dilithium) - Digital Signatures

• Security Basis: Module Learning With Errors
• Signature Size: 2420-4627 bytes (vs 64 bytes for Ed25519)
• Security Levels: 2, 3, 5 (128, 192, 256-bit equivalent)

SLH-DSA (SPHINCS+) - Stateless Hash-Based Signatures

• Security Basis: Hash functions only (most conservative)
• Signature Size: 7856-49856 bytes
• Use Case: Long-term archival signatures

ML-DSA-87 in Bio-DID-Seq

Bio-DID-Seq implements ML-DSA-87 - the final FIPS 204 standard, at the highest parameter set (NIST security category 5) - across identity, session authentication, and capability authorization.

A note on naming. ML-DSA-87 derives from CRYSTALS-Dilithium5, and the two are often used interchangeably. They are not interoperable: the standardized ML-DSA-87 differs from the pre-standard round-3 Dilithium5 implementations. Bio-DID-Seq uses the standardized algorithm exclusively.

Implementation Example

import { MlDsa87 } from '@ekayana/crypto';

// Generate post-quantum keypair
const keypair = await MlDsa87.generateKeypair();

// Sign a DID document
const didDocument = {
  '@context': 'https://www.w3.org/ns/did/v1',
  id: 'did:bio:z6Mk...',
  verificationMethod: [{
    id: 'did:bio:z6Mk...#key-1',
    type: 'JsonWebKey',
    publicKeyJwk: { kty: 'AKP', alg: 'ML-DSA-87', pub: keypair.publicKey }
  }]
};

const signature = await MlDsa87.sign(
  JSON.stringify(didDocument),
  keypair.privateKey
);

// Signature is quantum-resistant
console.log('Signature size:', signature.length); // 4627 bytes

Hybrid Cryptography: Belt and Suspenders

During the transition period, Bio-DID-Seq supports hybrid signatures combining classical and post-quantum algorithms:

This approach ensures:

• Current Security: Ed25519 protects against today's threats
• Future Security: ML-DSA-87 protects against quantum attacks
• Graceful Degradation: If either algorithm is compromised, the other provides protection

Performance Considerations

Post-quantum cryptography has larger keys and signatures, but modern implementations are practical:

For research data operations (typically measured in seconds), this overhead is negligible.

Migration Strategy

Phase 1: Inventory (Now)

• Identify all cryptographic dependencies
• Catalog data requiring long-term protection
• Assess quantum risk timeline

Phase 2: Hybrid Deployment (2025-2027)

• Deploy hybrid signatures for new data
• Maintain backward compatibility
• Monitor NIST guidance updates

Phase 3: Post-Quantum Primary (2028+)

• Transition to PQ-only for new systems
• Re-sign legacy data with PQ algorithms
• Deprecate classical-only signatures

Conclusion

The quantum threat to research data is real but manageable. By implementing post-quantum cryptography today, we ensure that sensitive research-from medical records to national security data-remains protected for decades to come.

Bio-DID-Seq's adoption of ML-DSA-87 positions research institutions at the forefront of this critical transition, providing quantum-resistant security without sacrificing usability.

---

References: NIST PQC Standards, CRYSTALS-Dilithium Specification, Quantum Computing Report