Castle Shield Holdings, LLC Adds Post-Quantum Cryptography (PQC) to Its Data-in-Motion VPN Solution

Castle Shield Holdings, LLC., has successfully integrated post-quantum cryptography (PQC) into its Aeolus VPN enterprise data-in-motion solution. Aeolus VPN now offers point-to-point asymmetric PQC and symmetric encryption for UDP and TCP on Windows, Linux and macOS platforms. Aeolus VPN offers a streamlined approach to privacy which results in more stability and lower latency that is a perfect addition to enterprise data-in-motion security for both classic and post-quantum computing environments.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20211011005150/en/

(Graphic: Business Wire)

In April, Castle Shield released Aeolus VPN which protects data between two or more network points. Please refer to our press release dated April 19, 2021, for additional product specification.

Post-Quantum Cryptography

PQC refers to a set of classical cryptographic asymmetric algorithms that are believed to be “quantum-safe,” meaning that they are expected to remain safe even in the presence of quantum computers. The National Institute of Standards and Technology (NIST) has narrowed down the original 69 submissions to 7 finalists and 8 alternate candidates. Castle Shield has integrated two of the NIST Round 3 finalists PQC asymmetric encryption. NIST will select a small subset of these algorithms that will form the core of the first post-quantum cryptography standards. Selected candidates from both the finalist and alternate groups will be announced in 2022 and 2024 respectively. NIST’s objective with PQC is to offer a secure mechanism for exchanging encryption keys that cannot be broken by quantum computers.

Why is Implementing PQC Important Today?

Many applications today are protected by asymmetric encryption key exchange protocols known as “public key cryptography” or PKC. Examples include RSA, RSA-EC, DSA, DH, and ECDH. These protocols rely on the assumption that it would take today’s most powerful classical computers thousands of years to solve certain mathematical problems (e.g., factoring large numbers or computing a discrete logarithm).

Quantum computers are expected to break these cryptographic schemes in short order. If quantum computers were widely available today, most, if not all digital communications using PKCs would potentially be compromised. While the date that quantum computers will be available is uncertain, it is important for companies, organizations, government entities, and individuals to start preparing for the impending quantum computing revolution.

What is the Significance of the Aeolus VPN and PQC Integration?

Castle Shield is taking a lead posture by packaging and productizing two of the PQC candidates and integrating them into off-the-shelf products. This demonstrates that Castle Shield has the capability to package and productize PQC algorithms. Given our encryption agnostic approach, Castle Shield will focus on the two leading candidates in each category and will update our use of the PQC’s as they evolve.

Specifically, the current PQC algorithms fall under two categories: Key Encapsulation Mechanism (KEM) and Digital Signature Algorithm (DS). The current PQC Finalist candidates are:

Public-Key Encryption/KEMs

• Classic McEliece
• CRYSTALS-KYBER
• NTRU
• SABER

Digital Signatures/DSAs

• CRYSTALS-DILITHIUM
• FALCON
• RAINBOW

Castle Shield implemented PQC SABER/KEM into Aeolus VPN. SABER characteristics include the following:

Source: https://openquantumsafe.org/liboqs/algorithms/kem/saber.html

Customers can choose which SABER parameter to configure into Aeolus VPN based on specific requirements of their organization. Our Aeolus VPN standard PQC configuration is SABER/KEM.

A Note About Performance

Aeolus VPN with PQC is slightly faster than its non-PQC counterparts especially at a load above 250Mbps. We will go into performance testing results in our next press release. The key takeaway is that Aeolus VPN with or without PQC performs in-line or better as compared to popular open-source VPNs.

Additional PQC Packages and Productizations are on the Horizon

Castle Shield has also packaged and productized CRYSTALS-DILITHIUM/DSA. We are in the late stages of testing, and we will announce the availability of product(s) using CRYSTALS-DILITHIUM/DSA at a later date. With SABER/KEM and CRYSTALS-DILITHIUM/DSA, we now have a PQC algorithm for both the KEM and DSA categories.

In Closing

“While many corporations and government agencies are focused on the asymmetric key exchange when preparing for the quantum era, Castle Shield has adopted a holistic cryptographic approach by including quantum-resistant encryption algorithms for both asymmetric and symmetric ciphers. It is true that symmetric ciphers, like the Advanced Encryption Standard (AES), are thought to be less vulnerable in the early part of the quantum era; however, Castle Shield has decided to offer solutions with both asymmetric (PQC) and symmetric encryption that are mathematically quantum-resistant. Customers can choose to enable both types of encryptions based on their specific needs. Castle Shield is currently the only cybersecurity solutions provider to offer quantum-resistant algorithms for both. In a world where data breaches, ransomware, and other cyberattacks are occurring daily, protecting our customer’s most valued asset, their data, should not be left to chance,” said Dr. Milton Mattox, Chief Technology Officer at Castle Shield, Holdings, LLC.

Aeolus VPN with PQC is available today for beta testing and proofs of concept. Customers may choose any one of the symmetric ciphers based on their needs. Aeolus VPN with PQC runs on Linux, Windows, macOS and works with both TCP and UDP which enables enterprises to securely encrypt point-to-point data-in-motion connections without compromising performance and flexibility. Lastly, the Castle Shield packaged PQC SABER/KEM library solution is also available to vendors and customers who wish to integrate PQC into their solutions.

About Castle Shield Holdings, LLC

Founded in 2019, Castle Shield offers a complete range of enterprise-grade cybersecurity solutions that protects enterprises and consumers against all internal and external cyber threats. Our quantum-resistant solutions (Fides) stand strong as the last line of defense for enterprise and consumer data in the emerging quantum computing threat landscape. Legion, our Security Information Event Management or (SIEM) product portfolio and Fides work together to strengthen your overall data security. We monitor and address threat vectors through our scalable, multi-tenant SIEM platform, protecting enterprise systems and data in an efficient, cost-effective manner. In addition, we utilize an advanced compliance platform (Senate) and expert analysis with an in-depth understanding of dynamic compliance standards and industry best practices to highlight cyber risk factors. Our Senate system provides comprehensive ratings for third party vendors based on technical risk scores, compliance, and financial impact in the event of a breach. Our 360° proactive security solutions are what sets Castle Shield apart independent of your IT backbone whether cloud, hybrid or premise based. For further information, please go to www.castle-shield.com.

View source version on businesswire.com: https://www.businesswire.com/news/home/20211011005150/en/