Announcing the Results of the Proof of Concept for Post-Quantum Cryptography (PQC) Technology in Online Services

Daiwa Securities Group Inc.
Daiwa Securities Co. Ltd.
Daiwa Institute of Research Ltd.
NEC Corporation
F5 Networks Japan G.K.
DigiCert Japan G.K.

Daiwa Securities Co. Ltd. (hereinafter 'Daiwa Securities') and Daiwa Institute of Research Ltd. (hereinafter 'Daiwa Institute of Research'), under the umbrella of Daiwa Securities Group Inc. (hereinafter 'Daiwa Securities Group Inc.'), in collaboration with NEC Corporation (hereinafter 'NEC'), F5 Networks Japan G.K. (hereinafter 'F5 Networks'), and DigiCert Japan G.K. (hereinafter 'DigiCert'), announce the results of a proof of concept (hereinafter 'demonstration') of Post-Quantum Cryptography [1] (hereinafter 'PQC') technology in preparation for the era of quantum computers.

This demonstration aimed to enhance the security of internet communication in Daiwa Securities' online services and conducted verification from a technical perspective toward the formal introduction of PQC.

With the progress in the development of quantum computers, it has been pointed out that the security of conventional public-key cryptography may be lost in the future. Believing that the early introduction of PQC is especially necessary for financial institutions handling important customer information, Daiwa Securities and Daiwa Institute of Research, along with NEC, F5 Networks, and DigiCert, who have specialized knowledge regarding PQC, conducted a demonstration using online services as an initiative toward the practical application of PQC in the securities industry.

We have compiled the results of this demonstration, along with considerations on trends such as standardization and how to proceed with the migration, into a white paper. The main points are as follows:

1. Demonstration Results
In internet communication, while the increase in processing time associated with PQC key exchange processing is limited, the volume of communication and the number of packets increase due to the larger key size. It became clear that prior confirmation is necessary for communication environments where sufficient bandwidth is not secured.

2. Standardization Trends
For some of the cryptographic processing used in internet communication, standardization in the industry is still in progress. We have clarified that a phased migration taking into account future standardization trends is necessary.

3. How to Proceed with PQC Migration
Since multiple cryptographic methods are used even in the system verified this time, it was suggested that it is effective to establish a structure specifically for considering cryptographic migration and to start creating a ledger that organizes the locations and methods of cryptography used to respond with an overview of the entire system.

Based on the verification results, we will formulate a policy for the formal introduction of PQC within the Daiwa Securities Group and promote the enhancement of security and the construction of a safe system infrastructure anticipating the practical application of quantum computers.

[1] Post-Quantum Cryptography (PQC) is a general term for cryptography considered capable of maintaining security even if a quantum computer with sufficient computational power is put into practical use.

■ Roles of Each Company
Daiwa Securities Group Inc.
Responsible for intra-group coordination/adjustment, progress, and risk management, and based on the verification results, formulated a policy for introducing PQC that balances security and convenience in the Daiwa Securities Group's online services.

Daiwa Securities
In this demonstration activity, evaluated interoperability when applying PQC to online services...