Most relevant post-quantum cryptographic algorithms are now supported by Bouncy Castle. And you can start experimenting with them already, with the help of hybrid cryptographic techniques.
The Bouncy Castle APIs now include implementations of the NIST Post Quantum Competition (PQC) algorithms announced for standardization: CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, and SPHINCS+. In addition to this, the following Round 3/Round 4 algorithms are also included: Classic McEliece, Picnic, NTRU, NTRU Prime, SABER, FrodoKEM, HQC, and BIKE. While a version of SPHINCS+ was available in BC 1.71, for BC 1.72 it has been upgraded to SPHINCS+ 3.1 and Haraka support has been added to it.
A low-level implementation of SIKE has also been made available for people wishing to study it in Java. However, owing to security concerns, we expect to remove the implementation in BC 1.73.
See the complete list of supported post-quantum algorithms in Bouncy Castle Interoperability.
Hybrid approach lets you combine regular and post-quantum algorithms
The Key Encapsulation Mechanisms (KEM) algorithms, such as CRYSTALS-Kyber, NTRU, or NTRU Prime, can also be used together with the HybridValueParameterSpec (added in Bouncy Castle 1.71) to quantum-harden a classical key agreement, or key generation based on a key derivation function (KDF), using the recently published method in NIST SP 800-56C Revision 2.
While NIST has announced some finalists, there is another call for signature algorithms continuing in Round 4, and it will still be two more years before final standards are available and users can commit to the new algorithms for long-term use.
With a hybrid approach combining the current PQC finalist algorithms with regular public key algorithms, you can safely experiment with post-quantum KEM without reducing the security of the classical algorithm. Consequently, this approach lets you introduce a level of post-quantum hardening and gain experience in using these new algorithms.
Watch the workshop and learn how to use the hybrid techniques
In a recently published workshop, Keyfactor’s David Hook and Roy Basmacier where they look at several standardized mechanisms for hybrid techniques as well as how they can be applied to the Bouncy Castle Java APIs, both FIPS and non-FIPS. Watch the workshop.
Get CPE Credits
Earn 0.5 CPE credit on this Workshop. Keyfactor is an Approved (ISC)2 CPE Submitter Partner.
