A common specification can give buyers and suppliers a clearer object to discuss. That is our market reading of NIST’s August 13, 2024 release of three post-quantum cryptography standards, not a finding that competition or prices changed. The agency said the standards were ready for use and urged administrators to begin integration, a process it acknowledged would take time. [nist]

Consider what a supplier’s reference to FIPS 203 actually identifies. The standard specifies ML-KEM, a mechanism for establishing a shared secret key over a public channel. Symmetric-key algorithms can then use the secret to protect communications. Describing ML-KEM as directly encrypting all of a customer’s data would obscure the boundary between key establishment and the rest of the service. [fips203]

FIPS 203 draws another boundary useful to buyers: conformance does not ensure that a particular implementation is secure, and using a conforming product does not guarantee overall system security. Our inference is that broad security advertising can leave customers comparing unlike claims unless suppliers explain the scope. These sources do not show that any actual vendor has made a misleading claim. [fips203]

For public communication, our editorial test is simple: describe the function supplied and avoid presenting an algorithm’s standardization as proof of a service’s complete protection. This is a proposed way to scrutinize claims, not official procurement advice or a certification checklist. NIST’s announcement and technical standard provide complementary information from one originating institution. Neither establishes supplier readiness, migration costs or a competitive winner as of the August 13 coverage date. [nist][fips203]

Source documents

  1. NIST Releases First 3 Finalized Post-Quantum Encryption Standards | NISThttps://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
  2. Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf