Reports

The paperwork layer

by Simon McCorkindale

Standfirst: A validated hardware security module, a bill aimed at the electricity grid, and a Finnish research programme pointing at the certificate layer. Three developments in one week say the same thing: the hard part of the post-quantum transition is no longer cryptographic. A fourth — a vendor blog doing the rounds again — is a reminder to read the byline before the argument.

The algorithms have been settled for two years. FIPS 203, 204 and 205 were published in August 2024, FN-DSA is coming as FIPS 206, and HQC has been selected as a code-based second key-encapsulation mechanism so the world’s primary KEM is not its only one. Nobody serious is still arguing about which maths to use.

What moved in the week to 21 August 2026 sits around the maths. A hardware security module (a tamper-resistant appliance that generates and stores private keys, performing operations internally so the key material never exists in ordinary software) cleared a validation bar. Two US senators introduced a bill putting quantum risk inside a regulator’s remit. A Finnish research programme published its read on where the transition gets stuck. Certificates, statutes and inventories — the paperwork layer, and where the transition now lives.

A validation, not a product launch

Canadian firm Crypto4A announced that its QASM cryptographic module — the core inside its QxHSM hardware security module (HSM) platform — has received NIST FIPS 140-3 Level 3 validation. The company’s claim is that this is the first HSM supporting the full set of NIST-standardised post-quantum algorithms to be validated at Level 3. The module executes ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), alongside the stateful hash-based scheme LMS, which matters for firmware and code signing.

The trade coverage is a company press release, republished, and the FIPS 140-3 certificate number was not locatable at the time of writing — the QASM entry visible in NIST’s validation database is still the FIPS 140-2 one from 2022. Ask for the certificate, not the announcement.

Level 3 concerns physical and logical protection: identity-based authentication, physical or logical separation of the interfaces through which critical security parameters enter and leave the module, and zeroisation of key material on tamper detection. That makes this a procurement event more than a technical one. An HSM is where the keys anchoring your PKI (public key infrastructure — the certificate authorities, certificates and trust chains binding keys to identities), your payments and your device identities physically live, and for government, defence and regulated buyers FIPS validation is the line in the contract that decides whether a product can be considered at all.

The sceptical note: a validated module validates the module. It says nothing about whether you know how many private keys you have, or whether the RSA root you generated in 2014 is still signing things you have forgotten about. Crypto-agility in an appliance is a capability; in an organisation it is a discipline.

Congress reaches for the grid

On 18 August, Senators Chris Coons and Mike Rounds introduced the Quantum Grid Utility Assurance and Resilient Defense Act — the Quantum-GUARD Act. Rounds framed it partly as codifying elements of Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks”, signed in June. It directs the Federal Energy Regulatory Commission to consider quantum-computing cybersecurity risk within its existing authority over grid reliability; establishes a testing environment through the Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response; and requires that office to study quantum risk across the bulk electric power system, covering both information technology and operational technology.

Several endorsements attached to the bill made the same point in different words: the cryptography is not the hard part; migrating the equipment already in the field is. This is a bill, not a law, and the mechanism is the notable part — rather than a new quantum statute, it inserts quantum risk into an existing reliability regulator’s field of view.

Finland’s read: PKI is the junction

VTT, Finland’s state technical research centre, published findings on 18 August from its BLimPQC project. The framing is unusually blunt for a research communication: the PQC transition is not an algorithm replacement, it is a long-term infrastructure transformation shaped by dependencies.

PKI is the choke point. A quantum-safe PKI is not produced by swapping an ECDSA signature for ML-DSA. It requires decisions about hybrid versus parallel certificate chains; how chains get updated without breaking connections to systems that have not migrated; how trust anchors handle PQC keys; and how issuance, renewal, revocation and audit work while several algorithms coexist for years. Underneath sits a size problem: PQC signatures and public keys are substantially larger than their classical equivalents, which lands on handshake latency and connection reliability, worst on constrained devices and lossy links.

VTT points to Merkle Tree Certificates as one Web PKI response. Rather than a certification authority signing each certificate with its own large PQC signature, a large set of certificates is bound into a tree whose root is signed once, and each certificate travels with a compact proof that it belongs to the signed set. This is not a thought experiment: Cloudflare’s published roadmap targets MTCs for visitor-facing connections by mid-2027. It is also the report’s broader argument in miniature — sometimes you cannot solve the problem by putting bigger signatures into the existing architecture, and the trust architecture itself has to change.

The sequence VTT sets out is the one we would give a client: inventory first, prioritise by how long the data must stay confidential, then build agility in so hard-coded algorithm choices do not become the next migration. It names the Cryptographic Bill of Materials, or CBOM, which does for cryptographic dependencies roughly what an SBOM does for software ones. The EU has no PQC-specific instrument, but NIS2, DORA, the Cyber Resilience Act and GDPR generate indirect requirements, and the roadmap dates are worth writing down: national transition strategies by end-2026, high-risk use cases migrated by end-2030, the broader transition completed as far as feasible by end-2035.

And one vendor post, read carefully

The fourth item is a Quantum XChange post asking whether RFC 9370 — the IETF specification allowing multiple key exchanges during IKEv2 security association setup, which is how hybrid post-quantum key establishment gets into IPsec — is enough. Its answer is no, and that you should be looking at products offering protection now.

Two objections hold up. Algorithm changes on IPsec estates generally mean coordinated downtime, which RFC 9370 does not fix. And the absence of FIPS-validated implementations is a procurement blocker for the buyers with the most urgency.

Three claims should not travel further.

The fragmentation objection is overstated. The 64 KB bound is real — the RFC states plainly that it does not attempt to address key exchange payloads longer than 64 KB, because the IKE payload format cannot carry them, and Classic McEliece public keys exceed that comfortably. But the post presents fragmentation as an unsolved hazard, when avoiding it is the design rationale for the mechanism: RFC 9370 routes the large key exchanges through IKE_INTERMEDIATE (RFC 9242) precisely so they are encrypted and can use IKE-layer fragmentation (RFC 7383), which is unavailable in IKE_SA_INIT. That moves the problem off the IP layer, where the middlebox-dropping concern lives.

RFC 9370 is not a standard-in-waiting. The post says the industry is waiting for it to become official over the next couple of years. It has been an IETF Standards Track document since May 2023.

No jurisdiction requires FrodoKEM. The post’s regional-divergence example has a US organisation required to use ML-KEM and a UK one FrodoKEM. NCSC guidance recommends ML-KEM-768 and ML-DSA-65, aligned with the NIST selections. FrodoKEM’s advocates are Germany’s BSI, which assesses it as suitable for long-term confidentiality, and France’s ANSSI, which encourages it as a conservative option for high-assurance use — assessment and encouragement, not a mandate. The example is wrong on both the country and the modality. The underlying point — divergence is real, crypto-agility is the answer — still stands.

An uncited figure about hybrid key exchange extending setup times by up to 30% under load likewise does not belong in a business case. The piece is a vendor arguing that an open standard is insufficient and its own product category is the interim answer.

The NZ read

The grid item lands hardest. Quantum-GUARD is aimed squarely at electricity infrastructure, and our June re-scan of 118 NZ critical infrastructure entities found Transpower, Vector, Mercury and Genesis all still negotiating classical key exchange at their origins. Water and wastewater remains at zero origin PQC. Transport is also at zero, and net PQC there fell from eleven to ten when KiwiRail lost the Imperva WAF that had been providing its PQC for it — an endpoint that regressed because a CDN contract changed, not because anyone changed a setting. If your post-quantum position is a function of someone else’s infrastructure decision, it is not a position.

The US is contemplating putting quantum risk inside FERC’s remit and the EU has three dated milestones; New Zealand remains the only Five Eyes member with no formal PQC migration deadline. The DPMC critical infrastructure consultation made no substantive mention of cryptography — we said so in our submission — and no public enforcement mechanism is attached to NZISM Section 2.4. The Critical Infrastructure Bill is expected later this year.

The HSM validation is a procurement lever. The question at the next hardware refresh is no longer “does it support PQC on a roadmap?” but “is the module validated, at what level, for which algorithms?” For the big four New Zealand banks, crypto and PKI decisions are effectively made in Sydney and Melbourne, on Australian refresh cycles. ANZ remains the only one running PQC at its origin.

The VTT sequence is the work. Of the classical origins we measured in April, 49 were still classical in June — no movement, and four months further into the runway. The 2029 date is no longer only Google’s and Cloudflare’s: Microsoft cut its own completion target from 2033 to 2029 at the end of June. Nine remain TLS 1.2-only, a prerequisite problem rather than a PQC one: X25519MLKEM768 requires TLS 1.3, so those nine cannot negotiate post-quantum key exchange even if everything else were ready. Where retention obligations run seven years under AML/CFT, or effectively indefinitely in health and legal records, the inventory is overdue rather than early.

The cryptography is finished. The certificates, the contracts, the validation certificates and the statutes are not — and those have lead times measured in years.

If it lives long, protect it.

Kaysec is the post-quantum security practice of Spinsphere, a New Zealand-based quantum technology company. We help NZ organisations with cryptographic inventory, HNDL risk assessment, TLS configuration auditing, PQC migration planning and NZISM Section 2.4 alignment. Get in touch.

References