US begins post-quantum upgrade of federal identity credentials

The U.S. General Services Administration (GSA) is beginning to move the federal government’s identity credentials and building access systems toward quantum-resistant cryptography.

GSA said this week that its Federal Identity and Cybersecurity Division is updating the Federal Identity, Credential, and Access Management (FICAM) architecture to support post-quantum cryptography while its laboratory for testing physical access control systems begins evaluating quantum-resistant technology.

GSA also disclosed that a new interagency working group charged with modernizing FICAM held its first meeting bringing together 40 participants from 17 federal agencies. The group plans to meet every two weeks and will address post-quantum cryptography along with non-human identities, automation and other changes in federal identity management.

The effort will impact Personal Identity Verification (PIV) cards.

Under the current National Institute of Standards and Technology (NIST) standard, a PIV card contains asymmetric cryptographic keys and certificates, two fingerprint templates and an electronic facial image. Iris images may also be stored on the card.

Quantum computing does not threaten the fingerprint or facial characteristics themselves. The concern is that the public-key cryptography used to authenticate credentials, establish secure connections and verify that digitally signed information, including biometric records, has not been altered or forged.

A sufficiently powerful quantum computer could break widely deployed public-key algorithms such as RSA and elliptic curve cryptography that conventional computers cannot practically defeat.

No cryptographically relevant quantum computer is known to exist, but the Office of Management and Budget (OMB) says continuing advances could produce one during the coming decade.

President Donald Trump’s June 22 executive order on advanced cryptographic attacks warned that adversaries can collect encrypted U.S. information today and preserve it until quantum computing becomes capable of decrypting it later, a threat commonly described as “harvest now, decrypt later.”

Two days after the order, OMB Director Russell Vought issued Memorandum M-26-15 on execution of the post-quantum migration which ordered civilian agencies to undertake a prioritized migration of cryptographic systems with the objective of eliminating as much quantum risk as feasible by December 31, 2030.

National security systems are excluded from the memorandum and are governed separately.

Agencies must give priority to high-impact systems, designated High Value Assets, and systems containing highly sensitive or long-lived mission data. They must also identify legacy systems that cannot accommodate post-quantum or hybrid cryptography and prioritize them for replacement or retirement.

Post-quantum upgrades are to be incorporated into cloud migrations, software development and hardware replacement rather than treated as a separate technology project.

The OMB memorandum also requires every agency to submit a post-quantum migration plan to OMB and the Office of the National Cyber Director by October 22.

The plans are supposed to move through discovery and planning during 2026 and 2027, pilots and early migrations in 2027 and 2028, and prioritized migration through 2030.

Post-quantum digital signatures for high-value and high-impact systems are targeted for 2031, with the remaining migration scheduled for completion by 2035.

The memorandum specifically ordered GSA to establish the FICAM modernization working group within 60 days, putting identity and access management directly into the post-quantum transition.

It also says GSA’s FICAM office is already working with agencies interested in testing post-quantum-ready physical and logical access systems. That work is now moving into GSA’s Physical Access Control System (PACS) laboratory.

GSA said the lab, which operates its Federal Information Processing Standards 201 Evaluation Program, is expanding its infrastructure to test quantum-resistant technology used in federal building access systems and employee identification cards.

The laboratory evaluates commercial physical access products for compliance and interoperability before they are placed on GSA’s FIPS 201 Approved Products List.

The current list includes systems and readers from vendors including HID, Genetec, Gallagher, Honeywell, LenelS2, AMAG and Avigilon, as well as approved PIV smart cards.

Federal acquisition rules require agencies purchasing PIV products and services to ensure they are approved as FIPS 201 compliant.

Future generations of card readers, credential validation systems, PIV cards and related infrastructure will have to accommodate new cryptography without cutting off the enormous installed base of existing federal credentials and access control equipment.

NIST has begun designing how that transition could work. In June, the agency released working drafts of changes to the PIV standards that would add post-quantum capabilities to federal credentials.

The proposed approach uses a dual-stack architecture that retains existing classical PIV keys and data objects while adding new key references, certificate containers and other structures for post-quantum credentials. This would allow agencies to introduce new cryptography incrementally while remaining compatible with systems that have not yet been upgraded.

The drafts contemplate using ML-DSA for digital signatures and ML-KEM for establishing cryptographic keys, which are among the first three post-quantum standards NIST finalized in August 2024 after a multiyear international evaluation process. The third, SLH-DSA, provides an alternative hash-based digital signature system.

GSA said its architecture work will also emphasize “crypto agility,” meaning systems are designed so cryptographic algorithms can be replaced without rebuilding the underlying application or infrastructure.

OMB’s memorandum makes the same principle a governmentwide objective, requiring prioritized systems to become cryptographically agile as they migrate.

The administration’s broader March Cyber Strategy for America calls for accelerated modernization of federal networks using post-quantum cryptography, zero-trust architecture and cloud computing.

It separately makes adoption of post-quantum cryptography and secure quantum computing part of its policy for maintaining U.S. superiority in critical technologies.

Trump’s June cryptography order also instructs the Federal Acquisition Regulatory Council to propose requirements under which covered federal contractors would have to comply with applicable NIST post-quantum standards by December 31, 2030.

GSA will bring government and industry representatives together in September for its Post-Quantum Cryptography Summit. The agency says the event will cover federal migration strategy, implementation and the commercial market for post-quantum technology.

Article Topics

access control  |  biometrics  |  GSA  |  identity management  |  PIV cards  |  post-quantum cryptography  |  U.S. Government