GSA Details Post-Quantum Work on Federal ID and Building Access

The US General Services Administration has set out how it is preparing federal identity systems for cryptography that a quantum computer could not break, covering both the architecture behind government credentials and the laboratory that decides which building access products agencies are allowed to buy.

The work sits with GSA’s Federal Identity and Cybersecurity Division and follows OMB Memorandum M-26-15, which directs agencies to move faster toward quantum-resistant security and hands GSA new interagency coordination duties. Dan Pomeroy, deputy associate administrator in the Office of Technology Policy, set out work running on two tracks, one cryptographic and one physical.

On the cryptographic side sits the Federal Identity, Credential, and Access Management architecture, the framework underpinning federal identity systems. GSA is updating it to support quantum-resistant algorithms while keeping compatibility with systems already in use, an approach it describes as crypto agility: the capacity to switch between encryption methods as threats change or standards are replaced, rather than committing to one algorithm.

Building access is the other track. GSA’s FIPS 201 Evaluation Program, run through its Physical Access Control System laboratory, is expanding to test quantum-resistant solutions for federal buildings, taking in employee badges, visitor passes and access controls. Under the Federal Acquisition Regulation, agencies may order access control equipment only from GSA’s Approved Products List, and it is the lab’s testing that determines what goes on that list. GSA called the enhanced lab infrastructure an entirely new capability requiring extensive research and development, and said it is starting to build quantum-resistant algorithms into the testing process.

The coordination piece is now running. M-26-15 directed GSA to establish an interagency working group on modernising the identity architecture, and its first meeting took place on August 12 with 40 participants from 17 federal agencies. The group intends to meet every two weeks and will take up non-human identities and automation alongside the cryptographic migration. GSA will also host a post-quantum cryptography summit this year.

Suppliers have been repositioning around the federal migration. Daon mapped five patents into a quantum identity architecture this month, and ATARC has published an implementation guide for the NIST digital identity transition aimed at agencies working through the same standards changes.

Sources: GSA

–

By Ali Nassar-Smith