Infineon and the BSI pave the way for a quantum-resilient future: World’s first Common Criteria Certification for post-quantum cryptography algorithm on a security controller

• Infineon receives world’s first Common Criteria EAL6 certification for implementing a post-quantum cryptography (PQC) algorithm in a security controller
• Internationally accepted certification is a crucial step towards a quantum-resilient world
• Post-quantum cryptography supports the protection of digital infrastructure from the future threats of quantum computers

Munich, Germany – 23 January 2025 – Infineon Technologies AG (FSE: IFX / OTCQX: IFNNY) has achieved a milestone on the way to a quantum-resilient world in collaboration with the German Federal Office for Information Security (BSI) [1]. Infineon is the first company ever to receive the Common Criteria EAL6, an industry-leading certification level, for the implementation of a post-quantum cryptography algorithm in a security controller. Such cryptography enhances security for eSIM, 5G SIM and smart card applications, including personal IDs, payment cards and eHealth cards, against threats resulting from highly capable quantum computers. The world’s first certification is a milestone on the way to a quantum-safe future in our daily lives.

Within the next ten to twenty years, quantum computers are expected to become powerful enough to break current cryptographic algorithms, compromising the security of our digital lives. Documents like eIDs that currently being issued and are valid for many years need to be resistant against future attacks by quantum computers. The same is true of encrypted messages and emails that are sent now, because when stored these can be attacked by quantum computers later. Post-quantum cryptography algorithms such as Module-Lattice-Based Key Encapsulation Mechanisms (ML-KEM) [2] are designed to resist these attacks, fortifying the integrity of our digital infrastructure. A secured implementation of these algorithms is crucial to withstanding classical security attacks.

Infineon’s latest achievement demonstrates the company’s commitment to providing future-proof security solutions. “With our innovations in post-quantum cryptography and active contribution to algorithm development, Infineon is an integral part in finding future-proof PQC solutions,” said Thomas Rosteck, Division President Connected Secure Systems at Infineon. “There is no question that quantum computers will be a reality; Therefore, we need to push forward with the migration to post-quantum cryptography decisively. Being the first company to receive the Common Criteria EAL 6 certification for post-quantum security is a testament to our dedication in protecting critical infrastructure and helping maintain the security of our customers’ data in a post-quantum world. This once again underpins Infineon’s leadership in the security industry.”

“The threats posed by quantum computers are becoming more and more real and are within reach,” said Claudia Plattner, President of the German Federal Office for Information Security (BSI). “The BSI consistently supports and demands the switch to post-quantum cryptography in order to make files and applications secure in the long term. The availability of quantum-safe IT products, which can also be found in numerous everyday applications, is therefore a real milestone!”

The international Common Criteria standard sets guidelines and criteria for the security of IT products and systems and is internationally recognized. By certifying Infineon’s secured implementation of a PQC algorithm with Common Criteria EAL 6, the BSI underlines the importance of resistance against classic attacks, like fault attacks, as well as quantum computer attacks. The ML-KEM algorithm was implemented on a TEGRION security controller, Infineon’s latest brand of 28 nm security controllers based on Infineon’s revolutionary security architecture Integrity Guard 32. The Common Criteria scheme was developed in collaboration among various governments and is recognized by governments around the globe. The certification itself takes place through various national institutions. Infineon’s TEGRION security controller has been evaluated and certified by the German BSI under the German Certification scheme.

EAL6 is a highly advanced level of assurance, indicating that the product or system has undergone a comprehensive and rigorous evaluation to confirm its security claims. The certified security controller combines high-performance processing with advanced cryptographic capabilities, providing a robust foundation for post-quantum cryptography. With this certification, Infineon is setting a new standard for the industry, paving the way for widespread adoption of post-quantum cryptography and for a safer digital future. And with the PQC era approaching fast, Infineon will continue working on further and more advanced quantum-resistant solutions.

[1] Bundesamt für Sicherheit in der Informationstechnik / Federal Office for Information Security

[2] Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) is a type of post-quantum key encapsulation mechanism that combines the hardness of lattice problems with the algebraic structure of modules to provide secure key establishment and encapsulation.