PQC Capabilities Matrix (PQCCM)

The PKI Consortium is managing a PQC Capabilities Matrix (PQCCM) of software applications, libraries and hardware that includes support for Post Quantum Cryptography, without endorsing their implementation or quality.

The list includes a wide variety of software applications, libraries, and hardware from different vendors. The list should be considered a living document and a starting point. Considering the rapid change in the area such things can vary from day to day and complete freshness of information can only be gathered from vendors directly.

The PKI Consortium is actively working to promote the adoption of Post-Quantum Cryptography, and the capabilities matrix is a key part of that effort.

What the PQCCM does:

• collects and aggregates information on PQC capabilities across the cybersecurity landspace (vendors, software, hardware, etc..)
• lists products that provide PQC functionality to the end user, not merely for example PQC enabled TLS access to a non PQC enabled service

No other activities besides those listed above are under the purview of PKI Consortium (unless explicitly stated otherwise).

What the PQCCM doesn’t do:

• review, vet, verify or test implementations or interoperability
• perform source code review, formal review of algorithms, etc.
• provide information, documentation or any recommended usage of Post Quantum Cryptography

Contribute

This list is a collaborative effort. To contribute please:

• Create an issue on GitHub.
• Create a pull request on GitHub.
• Participate in PKIC and the PQC working group and send an email to the list.

Legend

Capabilities

The table lists information from vendors related to support for Post Quantum Cryptography. The list below lista algorithms standardized by FIPS. The previous list listing support for draft algorithms can now be found in on the separate draftalgorithms page.

The list is ordered alphabetically by vendor, there is no other meaning to the order.

NOTE: HSS and XMSSMT are the multi tree variants of LMS and XMSS. In the table both the simple and multi-tree versions may be supported if LMS/XMSS is checked.

ANKATech

AnkaSecure is a REST API & SaaS platform designed to help organizations implement post-quantum cryptography (PQC) in real-world applications. It provides encryption, digital signatures, and key management using NIST standardized PQC algorithms. AnkaSecure supports ML-KEM, ML-DSA, SLH-DSA and Falcon through its API.

Botan

Botan is a C++ cryptography library released under the permissive Simplified BSD license. It offers the tools necessary to implement a range of systems, such as TLS protocol, X.509 certificates, AEAD ciphers, PKCS#11 and TPM hardware support, password hashing, and post quantum crypto schemes.

Bouncy Castle

Java and C# APIs with all NIST candidate support, and some older ones. Available as open source software. All NIST standards are available in Java from version 1.79 and C# from version 3.0.0.

The Bouncy Castle for kotlin open source package provides a script/command line interface for generating certificate chains with different algorithms, including hybrid certificates using X.509 section 9.8 alternative signatures.

Crypto4A

Crypto4A Technologies Inc. develops the crypto-agile and quantum-safe security products sold as the QxHSM™, a hardware security module (HSM) and the QxEDGE™, a hardware security platform (HSP). For more information about those products as well as the status of our FIPS 140-3 validation or CAVP algorithm list, please visit [www.crypto4a.com].

Entrust

nShield

The Entrust nShield Post-Quantum SDK enables post-quantum cryptographic applications for nShield HSMs with the CodeSafe SDK.

EVERTRUST

EVERTRUST Stream is a PKI CA/VA/TSA and EVERTRUST Horizon is a PKI RA and CLM software. Both products are currently able to issue and manage pure-PQC and hybrid backard-compatible certificates based on Dilithium/Falcon/Sphincs+ algorithms. Released versions have support for ML-DSA (with or without prehash), pure PQC certificates, and hybrid backward-compatible certificates as per ITU-T X.509 10/19. Other algorithms and some protocol support as well as PKCS#11 support is available in beta versions, as they depend on standards that are not yet published.

Eviden

IDnomic PKI

The Eviden IDnomic PKI supports the published PQC algorithms standardized by NIST : ML-DSA and ML-KEM. Composite and pure quantum certificates hierarchies can be provided.

Trustway Proteccio™ NetHSM

The Eviden Trustway Proteccio™ NetHSM supports all common cryptographic algorithms including the PQC algorithms selected by NIST : ML-DSA, ML-KEM and SLH-DSA.

Fortanix

Fortanix DSM support all NIST-approved PQC algorithms in FX 2200, available via SaaS and on-prem appliances. It enables enterprises to adopt quantum-safe cryptography today with full PKI support, including CA creation and X.509 certificates. Fortanix Key Insight provides key discovery and visibility, aiding PQC readiness.

I4P

Trident HSM is a general purpose network HSM developed by I4P that received the Common Criteria (CC) EAL4+ (EN 419221-5 as well as EN 419241-2) certification.

Cryptographic applications are enabled to use Post-Quantum algorithms even in the CC restricted mode that helps with using hybrid solutions and the transition to PQC.

Keyfactor

SignServer

SignServer performs server side signing and is capable of Post-Quantum signatures on CMS (RFC5662) messages as well as plain signatures. LMS, SLH-DSA and ML-DSA are supported from SignServer 9.1.

EJBCA

EJBCA PKI can create CAs and issue X.509 certificates signed using Post-Quantum algorithms. Available as open source software and containers with support for LMS, ML-DSA and ML-KEM from EJBCA 9.1, and SLH-DSA from version 9.3.

Nexus Group

Certificate Manager

Nexus Certificate Manager supports signing CA and X.509 certificates using ML-DSA and SLH-DSA algorithms from version 8.12 CM.

Open Quantum Safe

OQS is an open source software library that implements PQC algorithms, as well as integrations such as into OpenSSL.

OpenSSL

OpenSSL is an open source software library that implements PQC algorithms from version 3.5.

SafeLogic

CryptoComply PQ-TLS provides a drop-in TLS solution. It leverages SafeLogic’s CAVP-certified implementation of the ML-KEM algorithm to enable quantum-resistant TLS connections.

Securosys

Primus HSM, Primus X Cyber Vault and HSM as-a-service supports all common cryptographic algorithms, blockchain procedures including the PQC algorithms selected by NIST. Devices are under certification for FIPS140-3 Level 3 and CC EN 419221-5 (eIDAS protection profile).

References

The following table contains references to the PQC capabilities and algorithms.

Archived Draft Algorithm Support

This page is an archive of support for draft PQC algorithms, before standardization was completed. Most products remove support for the draft algorithms as standard algorithms are implemented.