Post Quantum Cryptography (PQC)

[HeikoAnkenbrand]

Post-quantum cryptography (PQC) comprises new encryption algorithms that remain secure even against attacks from powerful quantum computers, since current methods such as RSA and ECC are threatened by quantum algorithms (e.g., the Shor algorithm). These quantum-resistant techniques are based on complex mathematical problems that are difficult to solve for both classical and quantum computers, and they are implemented on classical hardware to make today’s IT systems future-proof. The NIST has initiated a standardization process to select and implement PQC algorithms in order to ensure long-term digital security.

• Which methods and ciphers are implemented in the Multi-Portal, Mobile Access Blade, and other Check Point portals?
• Which methods are planned or in use for VPN?
• Is there an SK or an official statement regarding what is planned for future versions, such as R82.10,...?
  
  
  

[PhoneBoy]

As far as I know, PQC has only been implemented in VPN in R82 (not for the other things you mentioned).
The documentation mentions ML-KEM and the  relevant IKEv2 RFCs: https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SitetoSiteVPN_AdminGuide/Content/T...

In other contexts, it’s not currently supported.
I presume we’ll support PQC for other contexts in the future, but don’t have any specific details.
If you’re looking for a formal statement, I suggest reaching out to the local Check Point office.

[HeikoAnkenbrand]

THX @PhoneBoy,

The German Federal Office for Information Security (BSI) has already published recommendations on Post-Quantum Cryptography (PQC). In its updated technical guideline TR-02102 “Cryptographic Mechanisms: Recommendations and Key Lengths”, PQC has been explicitly included under the section “Post-quantum algorithms for different application and security aspects.” This marks a significant step in Germany’s national approach to preparing for the cryptographic challenges posed by quantum computing.

The BSI warns that current asymmetric encryption methods, such as RSA and Elliptic Curve Cryptography (ECC), could eventually be broken by sufficiently powerful quantum computers—a risk often referred to as “store now, decrypt later.” This means that sensitive data encrypted today could be intercepted and decrypted in the future once quantum capabilities mature, highlighting the urgency of transitioning to quantum-resistant cryptographic methods.

Therefore, in Germany, we are increasingly required to support and implement PQC in government projects.

It would be great if you could provide a roadmap on this topic.