摘要：The security of widely used public-key cryptographic algorithms (e.g., RSA, elliptic-curve cryptography) is expected to deteriorate once large-scale and fault-tolerant quantum computers are developed. The potential threat is severe because such algorithms underlie the IT infrastructure in modern society, such as in the financial industry. Although the threat is unlikely to materialize in the foreseeable future, the National Institute of Standards and Technology (NIST) has been in the process of standardizing postquantum cryptography (PQC), which is designed to be secure against quantum computers. NIST has been scrutinizing the security and performance of 15 candidate algorithms (seven finalists and eight alternate candidates). Standardization should accelerate the migration to PQC around the world, not only within the U.S. federal government. In this paper, we discuss recent trends in the research and development of quantum computers and the security risks of public-key cryptographic algorithms. Then we review NIST's ongoing progress in standardizing PQC and the responses of other organizations in support of the migration. Finally, we discuss future challenges for the real-world implementation of PQC.
