The security chips found on personal identity cards and passports are under threat from quantum computing. But now, as part of its PoQuID research project, the Fraunhofer Institute for Applied and Integrated Security AISEC has developed cryptographic protocols that are tough enough to withstand attacks waged by quantum computers. The companies Infineon and Bundesdruckerei were partners in the project.

Electronic chips have been providing security for Germany’s EU passports since 2005 and for the country’s personal identity cards since 2010. German citizens can use the latter to authenticate themselves online (using what is known as the online ID function). A chip stores personal data and biometric features including a person’s passport photo and two of their fingerprints, and also features proof of its own authenticity. However, the cryptography that chips currently include will not be able to stand up to the attacks from the powerful quantum computers that are expected over the next ten to fifteen years — it is believed that these computers will have the ability to solve the mathematical problems underpinning this cryptography much quicker than today’s computers can. In this scenario, chips would no longer serve as an effective security feature.

A two-second security check

With this in mind, Fraunhofer AISEC set out to develop a quantum-secure chip in its PoQuID research project. The companies Infineon and Bundesdruckerei were partners in the project, which was funded by the German Federal Ministry for Economic Affairs and Climate Action (BMWK). “We adapted and refined Extended Access Control (EAC), the standard cryptographic protocol used in passports, in a way that ensured it would be quantum-resistant and still able to perform well with the limited resources available from a security chip,” says Prof. Marian Margraf, who heads up the Secure Systems Engineering department at Fraunhofer AISEC in Berlin and led the research project. “Our research work showed that the new protocol delivers the same security functions as its predecessor. It needs just two seconds of calculation time to check the security feature, making it suitable for both electronic passports at border controls and the online ID function.”

Combining two NIST PQC standards

To achieve this, Fraunhofer AISEC combined Kyber and Dilithium, two cryptographic algorithms drawn from the National Institute of Standards and Technology (NIST) standardization process for post-quantum cryptography. “NIST standardizes what are known as cryptographic primitives: building blocks that we can use to create cryptographic protocols,” explains Margraf. Dilithium is an asymmetric algorithm* that can be used for electronic signatures, while Kyber — also an asymmetric algorithm — deals with cryptographic key exchange.

“The research project has laid the foundations for ensuring that the security of electronic ID documents is fit for the QC age. Now, the race is on to get the technology to market,” says Margraf. The researcher believes that the international standardization process will take at least five years. “Additionally, authorities responsible for ID documents and security chip manufacturers have to bear in mind that ID documents can be valid for as much as ten years, but the first powerful quantum computers are expected to come onto the scene by the early 2030s.”

*Asymmetric encryption uses two keys: one for encryption and one for decryption. Symmetric methods, meanwhile, use just one key.