PQC in FIPS 140-3, status and roadmap
summary
Current state: approved PQC algorithms have required ACVP automated tests and production algorithm certificates can appear within days; three PQC algorithms released together in August shipped standards, annex entries, guidance and algorithm testing simultaneously. Roadmap: module validation still needs those algorithm certs plus module-level reviews, and a one-year CMVP report queue delays full FIPS 140-3 module approvals. Changes underway include a JSON security policy format and NIST/NCCoE proposals for module automation; NSA’s CNSA 2.0 adds extra demands like LMS for firmware signing.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:29FIPS 140-3 and CMVP overview
- 5:47Approved algorithms and prerequisites
- 7:31Algorithm validation with ACVP
- 10:23Post-quantum algorithms timeline
- 13:20Hybridization in FIPS 140-3
- 15:08FIPS 208 requirements
- 17:16FIPS 203 requirements
- 18:59SLH-DSA requirements
- 20:02Beyond minimum requirements
- 22:05Validation delays and automation
- 24:12Summary and PQC future
- 25:17Q&A on ISO 19790
- 28:04Q&A on validation levels
- 29:10Q&A on automation
related talks
44mQuantum Cyber Risk: How Deep and How Wide?
48mPreparing for Quantum: A Pragmatic Approach towards Readiness
33mPKI PKI and PQC Strategy for Payment Card Industry
13mNavigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools
48mWells Fargo PQC Program: The Five Ws
27mHow ETSI is Preparing for PQC
32mPQC in OpenSSL Library
36mSecurity compliance: A global perspective