US begins post-quantum upgrade of federal identity credentials

The U.S. General Services Administration (GSA) is beginning to move the federal government’s identity credentials and building access systems toward quantum-resistant cryptography.

GSA said this week that its Federal Identity and Cybersecurity Division is updating the Federal Identity, Credential, and Access Management (FICAM) architecture to support post-quantum cryptography while its laboratory for testing physical access control systems begins evaluating quantum-resistant technology.

GSA also disclosed that a new interagency working group charged with modernizing FICAM held its first meeting bringing together 40 participants from 17 federal agencies. The group plans to meet every two weeks and will address post-quantum cryptography along with non-human identities, automation and other changes in federal identity management.

The effort will impact Personal Identity Verification (PIV) cards.

Under the current National Institute of Standards and Technology (NIST) standard, a PIV card contains asymmetric cryptographic keys and certificates, two fingerprint templates and an electronic facial image. Iris images may also be stored on the card.

Quantum computing does not threaten the fingerprint or facial characteristics themselves. The concern is that the public-key cryptography used to authenticate credentials, establish secure connections and verify that digitally signed information, including biometric records, has not been altered or forged.