Federal agencies are preparing for the transition from cryptographic algorithms that may be vulnerable to future quantum computing attacks to quantum-resistant cryptographic algorithms standardized by the National Institute of Standards and Technology (NIST). Public key cryptographic algorithms (i.e. asymmetric cryptography) currently used across Federal information systems, products and services — including Rivest-Shamir-Adleman (RSA), elliptic curve Diffie-Hellman(ECDH), elliptic curve digital signature algorithms (ECDSA), and related mechanisms — will be vulnerable to a future cryptanalytically relevant quantum computer (CRQC). As a result, Federal agencies are expected to identify, prioritize, and migrate quantum-vulnerable cryptographic systems to approved post-quantum cryptographic algorithms. Federal agencies are also required to use validated cryptographic algorithms and modules when cryptography is required to protect Federal information or Federal systems. The NIST Cryptographic Module Validation Program establishes requirements under FIPS 140-2 and FIPS 140-3. FIPS 140-2 and FIPS 140-3 requirements are applicable to U.S. Federal agencies when cryptographic-based security systems are used to provide information security for Federal operations and assets. If cryptography is required for the protection of information or data, then FIPS-validated cryptography is applicable. Non-validated cryptography shall be treated as providing no validated protection for Federal information where validated cryptography is required. Relevant policy, standards, and guidance include, but may not be limited to: NIST Cryptographic Module Validation Program; FIPS 140-2 and FIPS 140-3, Security Requirements for Cryptographic Modules; FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard; FIPS 204, Module-Lattice-Based Digital Signature Standard; FIPS 205, Stateless Hash-Based Digital Signature Standard; NIST SP 800-208, Recommendation for Stateful Hash-Based Signature Schemes; NIST SP 800-52, Guidelines for the Selection, Configuration, and Use of Transport Layer Security Implementations; OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles; Executive Order 14306, Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity; Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks; OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography; and CISA guidance regarding product categories and technologies that use post-quantum cryptography standards. This RFI is intended to collect industry information regarding the availability, validation status, product and service readiness, procurement accessibility, implementation maturity, operational impacts, interoperability, and migration support associated with commercial products and services that support, or plan to support, NIST-approved post-quantum cryptography standards. This Request for Information is issued for market research purposes only. There are no anticipated tasks under this RFI. This RFI is intended to collect information from industry regarding vendor capabilities, products and services availability, cryptographic validation status, contract accessibility, and readiness to support the Federal Government’s migration to post-quantum cryptography (PQC). This RFI does not constitute a solicitation, Request for Proposal, Request for Quotation, Invitation for Bid, or promise to issue a future solicitation. Any contract or order that may result from information received through this RFI will be subject to applicable procurement laws, regulations, and competition requirements. The Government is not responsible for any costs incurred by industry in preparing or submitting responses to this RFI. All costs associated with responding to this RFI are solely at the respondent’s expense. Not responding to this RFI does not preclude participation in any future solicitation, if one is issued. All submissions become Government property and will not be returned.
