BSI-Compliant Post-Quantum Key Establishment: Implementation Pitfalls

Abstract

What Changed Since Version 2025-01

Compared with BSI TR-02102-1 Version 2025-01 dated January 31, 2025, the current Version 2026-01 dated January 23, 2026 introduces several concrete changes that affect migration planning and implementation design.

Key Points at a Glance

BSI TR-02102-1 Compliance Requirements

The BSI Technical Guideline TR-02102-1 Version 2026-01 updates the prior 2025 guidance with explicit migration deadlines, revised hybridisation guidance, and a clear end date for classical-only key agreement. BSI continues to target a minimum security level of 120 bits, continues to recommend hybrid deployment of quantum-safe and classical mechanisms during the transition period, and now states that sole use of classical key agreement is recommended only until December 31, 2031.

Note: the AES references are an intuitive mapping to NIST Security Strength Categories, not a claim that post-quantum mechanisms have identical security properties to AES-192 or AES-256.

BSI emphasizes cryptographic agility so that implementations can absorb future algorithm changes. In Version 2026-01, FrodoKEM-976, FrodoKEM-1344, ML-KEM-768, ML-KEM-1024, and the BSI-listed Classic McEliece parameter sets remain the active quantum-safe KEM choices for long-term confidentiality at the targeted security levels. The report also notes that HQC is intended for future inclusion after publication and review of the final standard, likely with parameter sets corresponding to NIST Security Strength Categories 3 and 5, but it is not yet part of the currently recommended set.

Comparative Analysis of Post-Quantum KEM Schemes

*Performance measurements are indicative and based on our test environment (Intel Core i7-10700K at 3.8 GHz). Actual performance varies significantly based on implementation and hardware.

FrodoKEM size values refer to the standard FrodoKEM parameter sets, not eFrodoKEM variants. Classic McEliece sizes depend strongly on the selected parameter set; the row above uses Classic-McEliece-6688128 as one representative BSI-listed parameter set.

Critical Implementation Vulnerabilities

Side-Channel Attack Resistance

FrodoKEM is often treated as a more conservative lattice-based option because it uses Learning With Errors over unstructured lattices rather than Module Learning With Errors. This can simplify some implementation-security arguments, but it does not provide automatic protection against timing, power, electromagnetic, cache, or fault attacks. Secure deployment still requires side-channel-resistant sampling, decapsulation, input handling, randomness generation, and key-erasure behavior.

BSI also motivates hybrid deployment partly because post-quantum mechanisms have not yet received the same long-term implementation and side-channel scrutiny as established classical mechanisms. For production systems, independent implementation review is therefore part of the security case, not an optional extra.

Migration Strategy and Best Practices

Successful migration to BSI-aligned post-quantum key establishment requires careful planning and systematic implementation. For high-assurance and public-sector systems, migration should be treated as a phased cryptographic modernization project rather than a simple algorithm replacement. Public reporting also indicates that the Bundeswehr wide-area network has been modernized with quantum-resistant encryption over a roughly 13,000-kilometer fiber network, but that deployment should be cited as an external example rather than treated as BSI benchmark data.

BSI Compliance Checklist

Organizations implementing post-quantum key establishment should assess alignment with BSI TR-02102-1 recommendations. This checklist synthesizes BSI recommendations from the technical guideline with practical implementation considerations discovered through our research.

Related Note on Quantum-Safe Signatures

Although this article focuses on key establishment, BSI TR-02102-1 Version 2026-01 also addresses quantum-safe signatures. BSI recommends hybrid quantum-safe signatures in combination with classical signatures, constructed so that the hybrid signature remains secure if at least one component remains secure. For new systems, the relevant quantum-safe signature families include ML-DSA and SLH-DSA parameter sets in NIST Security Strength Categories 3 and 5, while stateful hash-based signatures remain suitable only for scenarios with reliable state management. BSI follows the European transition roadmap and recommends migration to quantum-safe signatures by the end of 2035.

Illustrative Deployment Cost Considerations

Implementing BSI-aligned post-quantum cryptography can require significant engineering and operational investment. The following breakdown is an illustrative scenario model for a hypothetical €1M cryptographic modernization project, not a BSI estimate and not a universal deployment benchmark.

Actual migration costs depend on system inventory, protocol stack, public-key infrastructure changes, hardware replacement cycles, certification requirements, embedded-device constraints, and operational testing scope. Public reports about the Bundeswehr wide-area network indicate a major quantum-resistant encryption rollout, but public information is not detailed enough to infer a general cost model for commercial deployments.

Future Developments and Recommendations

BSI continues to evaluate additional post-quantum algorithms as the field evolves rapidly. Public information from DLR describes QUANTITY as a cooperation with BSI focused on quantum cryptanalysis and the development and dissemination of secure encryption methods in the age of powerful quantum computers. Version 2026-01 also explicitly points to HQC as a likely future addition after publication and review of the final standard. Organizations must therefore prepare for potential algorithm changes as cryptanalytic techniques advance and as the recommended set evolves.

Key recommendations for developers include implementing comprehensive side-channel countermeasures from the design phase, maintaining close alignment with BSI technical guidelines through regular updates, establishing partnerships with security evaluation laboratories for independent assessment, and contributing to open-source implementations to improve ecosystem security. The transition to post-quantum cryptography represents a fundamental shift requiring sustained investment and expertise development.

How to Cite This Article

@misc{pqcryptography_bsi_compliant_pqc,
  author       = {{PostQuantumSecurity.org}},
  title        = {BSI-Compliant Post-Quantum Key Establishment: Implementation Pitfalls},
  year         = {2025},
  month        = jun,
  day          = {1},
  url          = {https://www.postquantumsecurity.org/publications/bsi-compliant-pqc.html} 
}

References

1. Federal Office for Information Security (BSI). (2026, January 23). BSI TR-02102-1: Cryptographic Mechanisms: Recommendations and Key Lengths, Version 2026-01. BSI-TR-02102-1_2026-01.pdf
2. Federal Office for Information Security (BSI). (2025, January 31). BSI TR-02102-1: Cryptographic Mechanisms: Recommendations and Key Lengths, Version 2025-01. Archival comparison copy used for this update: BSI-TR-02102-1_2025-01.pdf
3. National Institute of Standards and Technology (NIST). (2024). FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard. https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf
4. National Institute of Standards and Technology (NIST). (2025). SP 800-227 Initial Public Draft: Recommendations for Key-Encapsulation Mechanisms. https://csrc.nist.gov/pubs/sp/800/227/ipd
5. Longa, P. (2025). FrodoKEM: Learning With Errors Key Encapsulation. IETF CFRG Internet-Draft. https://datatracker.ietf.org/doc/draft-longa-cfrg-frodokem/
6. DGAP. (2024). How Germany Can Improve Its Standing in Post-Quantum Cryptography. https://dgap.org/en/research/publications/how-germany-can-improve-its-standing-post-quantum-cryptography
7. ESUT. (2024). The Bundeswehr's wide area network is now encrypted in a quantum-resistant manner. https://esut.de/en/2024/01/meldungen/47046/weitverkehrsnetz-der-bundeswehr-jetzt-quantenresistent-verschluesselt/
8. DLR Quantum Computing Initiative. (2025). DLR × BSI: Working together for more security. https://qci.dlr.de/en/dlr-x-bsi-working-together-for-more-security/