BSI IT-Grundschutz Mapping

Mapping of the WvdS Post-Quantum Cryptography library to BSI IT-Grundschutz modules.

The BSI IT-Grundschutz Compendium¹⁾ defines security requirements for IT systems. This page documents how WvdS fulfills the relevant modules.

Module: Concepts and Procedures - Crypto Concept²⁾

CON.1.A1 - Selection of appropriate cryptographic methods:

// WvdS uses exclusively NIST-standardized algorithms
CryptoConfig.DefaultMode = CryptoMode.Hybrid;
 
// Available algorithms:
// - ML-DSA-44/65/87 (NIST FIPS 204)
// - ML-KEM-512/768/1024 (NIST FIPS 203)
// - RSA-2048/3072/4096 (classical)
// - ECDSA P-256/384/521 (classical)

CON.1.A4 - Appropriate key lengths:

Key lengths comply with BSI recommendations³⁾:

Module: Key Management⁴⁾

CON.5.A5 - Key derivation:

Key derivation functions comply with BSI recommendations⁵⁾ and NIST standards⁶⁾.

// HKDF (RFC 5869) for key derivation
var derivedKey = KeyDerivationExtensions.DeriveKey(
    sharedSecret,
    salt: cryptoRandom,
    info: contextInfo,
    outputLength: 32,
    HashAlgorithmName.SHA256
);
 
// Argon2id for password-based derivation (memory-hard)
var key = OpenSslKdf.Argon2id(
    password,
    salt,
    outputLength: 32,
    iterations: 3,
    memoryKiB: 65536,  // 64 MB
    parallelism: 4
);

CON.5.A6 - Key destruction:

// Automatic key destruction via IDisposable
using var keyPair = ctx.GenerateKeyPair(PqAlgorithm.MlDsa65);
// ... usage ...
// Dispose() calls SecureZeroMemory on private key bytes

Module: Logging⁷⁾

Relevance: TLS configuration for web servers

// Hybrid server certificate for TLS
var serverCert = request.CreateServerCertificate(
    intermediateCa,
    dnsNames: new[] { "api.example.com" },
    mode: CryptoMode.Hybrid  // ECDSA + ML-DSA
);

Relevance: Network devices with certificates

The BSI Technical Guideline TR-03116⁸⁾ defines specific cryptographic requirements:

• Compliance Overview
• NIS2 Directive
• Complete Audit Checklist
• BSI IT-Grundschutz (external)

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional