book

Transitioning to Quantum-Safe Cryptography on IBM Z

by Bill White, Didier Andre, Gregg Arquero, Ritu Bajaj, Joe Cronin, Anne Dames, Henrik Lyksborg, Alexandra Miranda, Maxwell Weiss

April 2023

Intermediate to advanced

190 pages

5h 48m

English

IBM Redbooks

Read now

Unlock full access

Trademarks
AuthorsNow you can become a published author, too!Comments welcomeStay connected to IBM Redbooks
1.1 When will quantum computers break cryptography1.1.1 Business risks1.1.2 Quantum threats and implications on data and identity1.2 Why are quantum computers a threat1.2.1 Cryptography overview1.3 Impact of Shorâ€™s and Groverâ€™s algorithms1.4 Cryptographic vulnerabilities possible with quantum computers1.5 New algorithms to counter CRQC attacks1.5.1 Quantum-safe algorithms1.6 Quantum-safe capabilities with IBM Z1.6.1 Quantum-safe infrastructure in IBM z161.6.2 Quantum-safe API functions available to application programs
2.1 Quantum-safe cryptographic experiences2.1.1 Educating the team2.1.2 Building a cryptographic inventory2.1.3 Creating a roadmap2.1.4 Designing and running with cryptographic agility in mind2.1.5 Quantum-safe journey in review2.2 Starting the quantum protection journey2.2.1 Following industry guidance2.2.2 Start now2.2.3 Building your inventory2.2.4 Knowing your options2.2.5 Incorporate cryptographic agility
3.1 Protecting sensitive data3.1.1 Problem statement3.1.2 Solving this challenge by using IBM z16 capabilities3.1.3 Industry applications3.2 Use case: Sharing keys securely3.2.1 Problem statement3.2.2 Solving this challenge with IBM z16 capabilities3.2.3 Industry applications3.3 Use case: Message integrity and secure logging3.3.1 Problem statement3.3.2 Solving the integrity challenge with IBM z16 capabilities3.3.3 Industry applications3.4 Proof of authorship3.4.1 Problem statement3.4.2 Solving this challenge with IBM z16 capabilities
4.1 IBM Z cryptographic components overview4.1.1 IBM Z cryptographic hardware components4.1.2 IBM Z cryptographic software components4.1.3 Minimum hardware and software for quantum-safe cryptography support4.2 Steps towards quantum protection4.2.1 Discovering and classifying the data4.2.2 Establishing a cryptographic inventory4.2.3 Considering cryptographic agility4.2.4 Adopting quantum-safe cryptography4.2.5 Where to find help at IBM4.3 Best practices, mitigation options, and tools4.3.1 ICSF best practices4.3.2 Mitigation options4.3.3 Key management tools
5.1 Collection tools overview5.2 Using ICSF cryptographic usage tracking5.2.1 Configuring SMF for ICSF cryptographic usage tracking5.2.2 Enabling cryptographic usage tracking within ICSF5.2.3 Formatting cryptographic usage statistics records5.3 Using IBM Application Discovery and Delivery Intelligence5.3.1 Configuring IBM AD Build Client for ICSF crypto analysis5.3.2 Interpreting IBM AD Build Client file results5.3.3 Interpreting the CRYPTO CAPIResolutions.json resolutions file5.3.4 Extending the CRYPTO CAPIResolutions.json resolutions file5.4 Using IBM Crypto Analytics Tool5.4.1 IBM CAT overview5.4.2 Reported elements5.4.3 Monitoring functions5.4.4 Crypto Analytics Tool use case5.4.5 Activating the policy5.4.6 Checking the policy5.4.7 Applying the policy to a snapshot5.5 Using IBM z/OS Encryption Readiness Technology5.5.1 Enabling zERT for zERT Network Analyzer5.5.2 Using IBM zERT Network Analyzer5.5.3 Monitoring data in-transit by using zERT
6.1 Quantum-safe algorithm artifacts6.2 Converting your PKDS to KDSRL format6.3 Ensuring the environment is ready6.4 Quantum-safe key generation6.4.1 Generating an AES 256-bit key by using ICSF CCA services6.4.2 Generating an AES 256-bit key by using ICSF PKCS #11 services6.4.3 Generating CRYSTALS-Dilithium key by using ICSF CCA services6.4.4 Generating CRYSTALS-Dilithium key by using ICSF PKCS #11 services6.4.5 Generating CRYSTALS-Kyber key by using ICSF CCA services6.4.6 Generating CRYSTALS-Kyber key by using ICSF PKCS #11 services6.5 Quantum-safe encryption6.5.1 Translating ciphertext to AES 256-bit encryption by using ICSF CCA services6.5.2 Translating ciphertext to AES 256-bit encryption by using ICSF PKCS #11 services6.6 Quantum-safe digital signatures6.6.1 Generating and verifying CRYSTALS-Dilithium digital signature by using ICSF CCA services6.6.2 Generating and verifying CRYSTALS-Dilithium digital signature by using ICSF PKCS #11 services6.6.3 Using digital signatures to protect SMF records6.7 Quantum-safe hybrid key exchange6.7.1 Performing a hybrid quantum-safe key exchange scheme by using ICSF CCA services6.7.2 Performing a hybrid quantum-safe key exchange scheme by using ICSF PKCS #11 services6.8 Quantum-safe hashing6.8.1 Hashing a message with the SHA-512 algorithm by using ICSF CCA services6.8.2 Hashing a message with the SHA-512 algorithm by using ICSF PKCS #11 services6.9 Validating your quantum-safe transition
A.1 Tools for cryptographic inventoryA.2 Investigation processA.3 Process that was used

B.1 CCA AES 256-bit key generation REXX sampleB.2 PKCS #11 AES 256-bit key generation REXX sampleB.3 CCA CRYSTALS-Dilithium key pair generation REXX sampleB.4 PKCS #11 CRYSTALS-Dilithium key pair generation REXX sampleB.5 CCA CRYSTALS-Kyber key pair generation REXX sampleB.6 PKCS #11 CRYSTALS-Kyber key pair generation REXX sample
C.1 CCA ciphertext translation REXX sampleC.2 PKCS #11 ciphertext translation REXX sample
D.1 CCA CRYSTALS-Dilithium digital signature generation and verification REXX sampleD.2 PKCS #11 CRYSTALS-Dilithium digital signature generation and verification REXX sample
E.1 CCA hybrid quantum-safe key exchange scheme REXX sampleE.2 PKCS #11 hybrid quantum-safe key exchange scheme REXX sample
F.1 CCA SHA-512 one-way hash REXX sampleF.2 PKCS #11 SHA-512 one-way hash REXX sample