BSI Expands Cryptographic Recommendations in Response to Quantum Computing Threat

Quantum computers have moved from theoretical concepts to tangible realities, posing a serious threat to sensitive data protected by current encryption methods. Long-term confidential information stored today could potentially be decrypted later using quantum computers—a vulnerability often described as “Store now, decrypt later.“

Traditional asymmetric cryptography methods like RSA or ECC no longer provide sufficient protection against quantum computer attacks. In response, Germany’s Federal Office for Information Security (BSI) has updated its TR-02102 “Cryptographic Methods: Recommendations and Key Lengths” with significant revisions to its post-quantum cryptography guidelines.

The Complexity of Transitioning to Quantum-Resistant Cryptography

The transition to post-quantum cryptography presents more challenges than simply increasing key lengths to counter growing conventional computing power. This complexity stems primarily from the need for complete algorithm replacement, requiring new implementations and integration into numerous protocols and standard applications before widespread deployment. Recognizing the urgency, BSI has published specific action recommendations and joined with 17 European partners to call for active transition of the most sensitive applications to quantum-resistant methods by 2030 at the latest.

Expanded Portfolio of Post-Quantum Methods

The updated TR-02102 offers a diverse selection of post-quantum methods for various applications and security requirements. This expansion includes the recommendation of three new NIST standards:

• ML-KEM for key exchange
• ML-DSA and SLH-DSA for signature processes

These additions complement the recommendations made since 2020 for key exchange methods FrodoKEM and Classic McEliece, which are currently being standardized at ISO with active BSI participation, as well as the signature methods XMSS and LMS.

Tailored Solutions for Different Use Cases

The variety of PQ methods allows organizations to select the most appropriate protocol for specific implementation scenarios:

• XMSS is well-suited for ensuring the authenticity and integrity of firmware updates
• Stateless signature methods like ML-DSA or SLH-DSA are better suited for authentication during key exchanges, such as in the TLS protocol for secure internet communications

With this expanded portfolio, BSI establishes a solid foundation for future-proof technology competence and strengthens trust in digital system security.

About TR-02102

Since 2013, BSI has annually updated the Technical Guideline TR-02102, which contains recommendations on cryptographic methods and key lengths. These recommendations serve as the cryptographic basis for BSI specifications in the TLS Minimum Standard and the Technical Guideline TR-03116 (Cryptographic Requirements for Federal Government Projects), as well as for the development and evaluation of secure IT for the German federal government. They also provide general guidance for individuals who need or want to make cryptographic decisions, particularly administrators and developers.

Why This Matters for Organizations

The move toward quantum-resistant cryptography represents one of the most significant transitions in information security of the past decades. Organizations handling sensitive data, particularly those with long-term security requirements, need to begin planning their migration strategies immediately. While functioning quantum computers capable of breaking current encryption aren’t yet available, the lengthy implementation process for new cryptographic systems means preparations cannot wait.

Government agencies, financial institutions, healthcare providers, and critical infrastructure operators should pay particular attention to these recommendations, as they handle precisely the type of data most likely to be targeted in “harvest now, decrypt later” attacks. The BSI’s expanded portfolio of recommended algorithms provides these organizations with flexible options that can be matched to their specific operational and security requirements.

The guidelines also highlight the importance of international cooperation in establishing cryptographic standards that can withstand quantum computing threats, ensuring that digital security remains resilient in the face of rapidly advancing computing capabilities.