Post-Quantum Cryptography | Public Sector Solution Brief
Quantum-Ready Today: Discover, Asses, Prioritize, and Transition Vulnerable Cryptography
The public-key cryptography securing federal systems, including RSA, ECC, and Diffie-Hellman, will not survive a cryptographically relevant quantum computer (CRQC). With cryptography embedded in every application, network, and device, replacing it is a multi-year effort, and policy has now put firm deadlines on it. Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (June 2026), directs OMB to require agencies to transition all high value assets (HVAs) and high impact systems to NIST-approved post-quantum cryptography (PQC).
The order sets December 31, 2030, for key establishment and December 31, 2031, for digital signatures. For National Security Systems (NSS), NSA’s CNSA 2.0 expects new acquisitions to be compliant starting January 1, 2027. Federal contractors are next: the order also calls for a FAR rule requiring covered contractors to meet PQC-inclusive FIPS by the end of 2030. While the deadlines are clear, the path to meeting them is not. Every migration starts with the same question: where is our cryptography, and how much of it is quantum-vulnerable?
Power the Way to a Quantum-Safe Future with Fortanix
Fortanix answers that question, then turns PQC complexity into a clear, three-step path to compliance. On a single platform, agencies get visibility into their cryptography, a prioritized roadmap, and a disruption-free transition. Crypto-agility underpins every step: as standards, threats, and mandates evolve, agencies can adopt new algorithms without changing key management systems or HSM deployments, so the next change is a policy update, not a re-architecture.
Discover
Map your entire cryptographic security posture. Inventory every encryption key, certificate, and algorithm across multicloud, on-premises, and HSM environments, with visibility into where keys live, their status, and how they’re used.
Assess & Prioritize
Benchmark your posture against quantum threats. Heat maps and a prioritized list show which quantum-vulnerable assets matter most, starting with HVAs and high impact systems, so you can build a PQC migration roadmap aligned to mission impact.
Transition
Move to NIST-standardized PQC algorithms, including the full CNSA 2.0 suite, under centralized key and policy management. Test readiness before deployment, track progress centrally, and transition without disrupting operations.
Key Insight Coverage Across the Tech Stack
How It Works
Fortanix Key Insight shows you what to fix. Fortanix Data Security Manager (DSM), a FIPS 140-3 Level 3 certified HSM with built-in KMS, gives you the control to fix it.
- Discover Yor Key Services: Key Insight connects to cloud accounts, on-premises scanners, HSMs, and external key sources. It continuously catalogs every encryption key, its lifecycle status, and the data services it protects.
- Certificates & networks: TLS/SSL versions, client/server auth, certificate-to-key mapping.
- Encryption keys: asymmetric (RSA, ECC) and symmetric (AES, DES and more).
- Applications & services: databases, middleware, source code and DevOps pipelines with embedded crypto.
- Key lifecycle: sizes, validity, expiration, policy alignment and key-to-service mapping.
- Catalog in a CBOM: Key Insight imports Cryptographic Bills of Materials (CBOMs) in OWASP CycloneDX 1.6 or CSV format, so vendor and existing inventories sit alongside discovered assets, ahead of CISA’s CBOM minimums under EO 14412.
- Have a Unified View: A comprehensive dashboard shows what share of assets is quantum-safe, flags vulnerable keys, and tracks a cryptographic security score for oversight reporting.
- Prioritize by Risk and Mission Impact: Data-driven heat maps, service-key relationship diagrams, and blast-radius assessment show which at-risk services matter most and help you separate quick wins from longer-term projects for a phased transition.
- Transition with Control: DSM centrally manages keys, algorithms, and permitted key operations. It enforces policy and lets you test readiness before deployment to prevent outages. Findings flow to ServiceNow and Jira for tracking.
- Deploy Your Way: Available as SaaS, on-premises, or air-gapped environments for classified and sovereign missions.
- Drive Crypto Agility: Transition to PQC algorithms in Fortanix DSM and through PKCS#11, CNG, KMIP, and JCE integrations.
- Stay Aligned with Policy: Validate discovered assets against recognized frameworks, including NIST SP 800-57, PCI DSS, CMMC, ISO and CIS, and agency policies, tracking PQC readiness alongside compliance.
Supported Post-Quantum Algorithms
| Algorithm | Function | Specification | Parameters |
|---|---|---|---|
| Advanced Encryption Standard (AES) | Symmetric block cipher for information protection | FIPS PUB 197 | Use 256-bit keys for all classification levels. |
| CRYSTALS-Kyber (ML-KEM) | Asymmetric algorithm for key establishment | FIPS PUB 203 | Use Level V parameters for all classification levels. |
| CRYSTALS-Dilithium (ML-DSA) | Asymmetric algorithm for digital signatures | FIPS PUB 204 | Use Level V parameters for all classification levels. |
| Secure Hash Algorithm (SHA) | Secure Hash Algorithm (SHA) | FIPS PUB 180-4 | Use SHA-384 or SHA512 for all classification levels. |
| Leighton-Micali Signature (LMS) | Asymmetric algorithm for digitally signing firmware and software | NIST SP 800-208 | All parameters approved for all classification levels. SHA-256/192 recommended. |
| Xtended Merkle Signature Scheme (XMSS) | Asymmetric algorithm for digitally signing firmware and software | NIST SP 800-208 | All parameters approved for all classification levels. |
