PQC In Digital Identity: State Of The Art And Way Forward [Intermediate]

Okay, back next. Good morning everybody, Andrea from Forkbomb. We are open source developers focusing on cryptographic components and solutions primarily on digital identity. So there will be a little bit of overlap between my presentation and one of Paul. I will go through, I will focus on the NIST standards because that's the stuff we've been working on. We will talk a little bit about AOD Wallet, but as well as the work being done overseas by the W3C Foundation about document digital signatures and about what is being done on zero-knowledge proof on the post-quantum cryptography.

I put a QR code here because this presentation I also put it on a web page. There are a lot of links in the presentation, so if you want to follow with your laptop and click on the links, you can just scan. I think that the QR will be also seen in the end.

Okay, let's get started. So, first of all, what is post-quantum cryptography? Post-quantum cryptography is cryptography running on today's computers that resist quantum computers. Post-quantum cryptography is not computation running on quantum hardware. There are different branches working on quantum hardware like quantum key distribution and quantum networks, but that doesn't cover what we're talking about today. Why this was covered already by Paul?

So, the Shor algorithm from 1994 predicted that quantum computers would break RSA and elliptic curve cryptography. What does PQC look like?

So, on the left side, you see an elliptic curve using cryptography. So, it's basically elliptic curve cryptography is based on curves with points moving on a curve. On the right side, you see what a lattice from MLDSA slash the lithium okyber looks like.

The NIST, which is the US standard organization, has started competition in 2016. The competition elected some winners in 2024.

Last year, in August, three of the four winners were standardized. The winners are Kyber, which became MLChem, which is used for NTLS, as they mentioned before, and two signature algorithms, namely Dilithium, that became MLDSA, and Sphinx, that became SLHDSA. It's very important to know that the performances of these algorithms are comparable to existing cryptography, but the signature sizes are not. As you can see, MLDSA, the signature is 3.2 kilobytes. Sphinx produces a gigantic signature, it's 41 kilobytes or 30 kilobytes in the revised version.

In comparison, ECDSA and EDDSA produce a signature of 64 bytes. So, we're talking about two orders of magnitude bigger. Falcon is still being worked on and they announced a new one, a new KEM this year, in case Kyber breaks. Very important to understand, all those cryptographic functions, all those cryptographic algorithms are, the first implementation is in C. Other implementations done by third parties have been done. For example, there is a large implementation done by Cloudflare in Go, then there is Bouncy Castle in Java.

All the implementations the reference implementations are collected in two repos, one called Leap OQS, one called PQClean, available on GitHub. So, what has been done on the other side of the ocean, on W3C, Verifiable Credentials? We have been working on a community group. We started last year. We haven't done much until now. We're going to update it in June, because we have implemented a working prototype of a issuer that produces a W3C Verifiable Credential with an MLDSA, so with a quantum proof signature. That's the work we've done.

We have a repo on it and I'll show you later how you can try it at home. This is how a W3C VC is produced. You probably don't want to read all of this, so this is for the people that scan the QR code, you can have a look at it later. This is a mermaid of how the VC is produced. The interesting part where I put the troll face is the canonization, which is something I believe is missing in SDGOT.

So, basically at some point the credential is hashed in a canonized way, which helps sorting and it helps issues with verification. This is what W3C VC with an MLDSA signature looks like.

So, the gigantic green thing is the 3.2 kilobyte signature I mentioned before. So, our work in PQC, we have implemented a core component which is a cryptographic virtual machine written in C called Zenroom.

So, what we did is that we took the reference implementation of the PQC algorithms from the C repos, we plugged them in our virtual machine and within a few days we had PQC capabilities. The virtual machine runs on all the OS, on all the architectures and in the browser. If you want to try it at home, you scan the QR code and you land on this page which is going to be a swagger.

So, you can try and click on the swagger buttons to generate a signature or to verify it. And all of this is open source.

Okay, AudiWallet, this has been covered before. I think I just have two slides.

So, goal number one is to produce a qualified attestation and an attestation. Goal number two, which is harder, is to produce a PID.

PID, I don't think it's been mentioned before, but in AudiWallet there are different levels of credentials. PID is the core credential which contains personal data.

So, tech requirements, goal one is to have issuers and verifiers to sign and verify credentials. Goal two is to have mobile applications to do that, which is way harder because an HSM is required.

So, this part, what algorithms we would trust, I put a troll face because there are Horizon projects coming up now. So, research projects sponsored by the European Commission that ask cryptographers to develop new algorithms. If someone wants to know why, ask me a question later. This is what we created. We created an SDGOT sign with MLDSA about a year ago. That is what it looks like, but this has been covered before by Paul.

So, document signature. I think that many of you have signed PDF documents digitally. The standards are called star ADAS, which means PADAS, KADAS, XADAS, JADAS. What needs to be done for this is, first of all, you need a CA to produce an X.509 with, most likely, a hybrid signature.

So, you're going to have a traditional RSA, ECDSA, DDSA signature plus a PQC signature. Then you need a software to be able to read the X.509, to sign a document, to sign a PDF. Then you need another software to take the PDF, the signature, encapsulate it in a new PDF. Difficulty, CA part should be easy. Producing a signature should be easy. Embedding it should be easy. The client part is harder because then we need to convince Adobe and Microsoft and Google to embed it in the browsers. The standardization part is harder.

So, we need a standardized X.509, standardized ADAS, and we need the vendors to adopt it. And the star ADAS, that's a European standard covered by the ETSI standards I mentioned, while the X.509 is a global standard. There you have a link of the IETF work in progress that is optimistically going through that. I think my time is over.

No, good. PQC zero-knowledge proof in collaboration with Qubip. Qubip is an Horizon, one of the two Horizon projects that won the first round of post-quantum cryptography two years ago. The goal is issuance and verification of VCs with selective disclosure and zero-knowledge proof.

So, they started researching and they picked a paper, nicknamed BLNS, from the names of the authors, Butl, Lyubashensky, Nguyen, and Sorniodi. The name of the paper is written there. And they also published a first analysis of the paper.

So far, what they have is an implementation, I believe, written in Rust. I spoke with the developers and in October they said that they found 100 issues in the math, meaning that this will require some work. Nevertheless, this is still the most promising implementation, well, the most promising math paper. It uses the same math of Falcon, which is Lactis. It is similar to the one used in Kyber. What needs to be done is work, first of all, on efficiency, because the secret key generation takes minutes right now. And they need to work on security to prevent channel attacks.

How long this will take to become usable? So, probably a few years until a working prototype is out there, and five to ten years for standardization. Bonus.

So, if you land on this page, you will see a tiny application that we wrote in one night that allows you to encrypt a document or a file using a combination of MLDSA and AES and send it over to somebody else and along with your MLDSA public key, and the other person can decrypt it. All right, now my time is done, I guess. That was the last slide. The presentation is here. You're very welcome to reach out at my email address. Thank you very much, Andrej.

Again, if anybody has questions, please raise your hand. Well, I guess I would probably have a silly question of my own.

So, this is all sort of very technical for a person even like me, an analyst. Even more difficult, I guess, for end users and laymen to understand.

So, what would be your kind of biggest takeaway for those kinds of people? How can we, quote-unquote, mere mortals, influence, push these developments further? What do we have to do? Push or use? Encourage guys like you to do it faster. It depends on what of the parts that I mentioned here you want to talk about. Because when it comes to, for example, to Paytas, there is Etsy working on some standards, and that will take time.

PQC, ZKP, they're doing research. W2CBC and AOD, AOD Wallet.

So, I was very happy to know that they have an implementation that works already. If they have an implementation, and they talk with the people working on the technical reference, maybe we can push it further. Maybe we can have something working soon.

In W2CBC, I guess that by the end of the year, we're going to have a working prototype that people can use. Okay, well, thank you very much.