Australia to Phase Out Weak Encryption Algorithms by 2030

Australia has rolled out an ambitious roadmap to prepare for future quantum-enabled cyberattacks. Regulators are ready to set an end date for several existing encryption algorithms in 2030 – five years earlier than the deadline set by National Institute of Standards and Technology in the U.S.

See Also: Cyber Insurance Assessment Readiness Checklist

The Australian Signals Directorate last week issued a list of approved asymmetric cryptographic algorithms that organizations must incorporate to secure data at rest or in transit from quantum-enabled cyberattacks at some point in the future.

The ASD guidance named permitted cryptographic algorithms for different purposes, such as Elliptic Curve Diffie-Hellman, or ECDH, to encrypt session keys, Elliptic Curve Digital Signature Algorithm, or ECDSA, and Module-Lattice-Based Digital Signature Algorithm, or ML-DSA, to encrypt digital signatures, and RSA to transport encryption session keys.

Though the Australian Signals Directorate approved known algorithms – such as SHA-2 as the hashing algorithm for general purpose use, AES as the only approved symmetric cryptographic algorithm, and SHA-3 for use within ML-DSA and ML-KEM – it also laid down minimum security requirements for various algorithms based on their ability to defeat cyberattacks that could employ quantum computers.

For instance, encryption algorithms for top secret data must have at least 192 bits, encryption for secret data must have 128 bits, and official, sensitive and protected data must have a minimum of 112 bits. The same applies to algorithms protecting non-classified data.

The ASD guidance follows the U.S. Department of Commerce’s NIST guidance, which released three encryption algorithms in August that the agency says have proven through multiple rounds of tests to be capable of defeating quantum-enabled cyberattacks.

NIST said in an initial public draft on transition to post-quantum cryptography standards in November that certain existing encryption algorithms will be disallowed in 2035, giving organizations about a decade to implement post-quantum encryption algorithms.

The list of sun setting algorithms includes EDCSA and EdDSA, or Edwards-curve Digital Signature Algorithm with 128 bits of security strength and RSA for digital signatures with no more than 128 bits of security strength.

NIST also by 2035 wants to disallow a list of quantum-vulnerable key establishment schemes that include 128 bit RSA, Elliptic Curve DH and MQC with 112 bits and 128 bits, and Finite Field DH and MQV with 112 bits and 128 bits of security strength.

It may be a decade or more before developers build the first cryptographically relevant quantum computer, but the work on post-quantum cryptography must begin now, the agency said.

“Encrypted data remains at risk because of the harvest-now, decrypt-later threat in which adversaries collect encrypted data now with the goal of decrypting it once quantum technology matures,” it said. “Since sensitive data often retains its value for many years, starting the transition to post-quantum cryptography now is critical to preventing these future breaches.”

Bill Buchanan, professor of cryptography at Edinburgh Napier University, wrote in a blog post that Australia has gone a step further than NIST by setting the 2030 end date for vulnerable cryptographic algorithms including SHA-256, RSA, ECDSA and ECDH.

In addition to the deadlines, the agency nudged organizations to migrate to High Assurance Cryptographic Equipment, or HACE – specialized equipment used to protect highly sensitive information. These devices prevent the leakage of data held in device memory, ensure functional correctness of algorithms, and protect against timing side-channel attacks carried out remotely.

Australia signaled its intent to enforce next-generation post-quantum cryptography standards in its eight-year National Cyber Security Strategy released in 2022, stating that advances in quantum computing technology meant that existing encryption technology may not be able to secure data in the future.

The National Quantum Strategy, published in May 2023, also formalized the government’s intent to invest in quantum research and industry, incentivize the continued growth of quantum use cases, make Australia the world’s top destination for quantum talent and use the National Reconstruction Fund to fund industry-ready quantum technologies.