Cryptographic Module Working Group Charter
Cryptographic Module Working Group Charter (CM)
This Working Group Charter has been created according to the “Working Groups” section of the Bylaws of the PKI Consortium (“PKIC”). In the event of a conflict between this Charter and any provision in either the Bylaws or the IPR Policy, the provision in the Bylaws or IPR Policy shall take precedence.
Summary of the Working Group
| Name | Cryptographic Module |
| Abbreviation | CM |
| Mission | Uniting experts across industries, the CM WG acts as the PKI Consortium's central authority for addressing Cryptographic Module (CM) and Hardware Security Module (HSM) topics. |
| Chair | Zsolt Rózsahegyi (i4p informatics) |
| Vice Chair | Daniel Cervera (Microsoft) |
| Communication | Private mailing list, Virtual meetings, Community discussions |
| Meeting schedule | Virtual meetings: approximately once every two weeks |
| Type(s) of members eligible to participate | All Member types of the PKIC that express interest in this Working Group |
| Voting structure | According to the PKIC Bylaws |
| Expiration | This Working Group is chartered indefinitely until it is dissolved |
| Members |
A
The Agence Nationale pour la Sécurité Informatique et la Certification Électronique (ANSICE) is the national authority of the Republic of Chad responsible for i…
A provider of PKI and other security-related services staffed by a team of dedicated professionals with 30+ years operational experience and security expertise.
Airbus is a global pioneer in the aerospace industry, operating in the commercial aircraft, helicopters, defence and space sectors.
As an international financial services provider, Allianz offers worldwide products and solutions in insurance and asset management.
We provide a complete educational experience and a values-based culture on our modern campus in the heart of West Texas. We are the Ram Family. Join us today.
Consulting on public key infrastructure solutions to organisations in the UK for nearly 20 years to a range of government, public and private sector organisatio…
AppViewX develops products for machine identity management, PKI, and cryptographic automation.
Since 2001, Ascertia has been a global leader in delivering high-trust e-security solutions focusing on Digital Signatures, Timestamps, Evidence Archiving and O…
Astradi is a provider of post-quantum cryptography (PQC) solutions, dedicated to securing digital communication and data against the threat of quantum computers…
B
Digital mobile identity based on eSIM, SIM and PKI technologies
O Bradesco é um dos líderes do setor financeiro privado e um dos maiores empregadores na categoria. Além disso, apresenta o melhor índice de eficiência entre os…
C
Delivering end-to-end cybersecurity solutions and strategic advisory to strengthen cyber resilience, supported by mature SecOps and a dedicated Security Operati…
CNA provides a broad range of standard and specialized insurance products and services for businesses and professionals in the U.S., Canada and Europe.
The Center of Excellence for Information Security at King Saud University is a non-profit center that aims to develop and provide innovative security solutions…
CSTI Consulting is a Brazilian boutique technology consultancy specializing in Microsoft Identity and Security infrastructure.
Chunghwa Telecom Laboratories specializes in developing PKI systems and serving as a PKI provider in Taiwan.
Citi's mission is to serve as a trusted partner to our clients by responsibly providing financial services that enable growth and economic progress. We have set…
Cleverbase offers a mobile app which, after a one-time registration, you can use to place qualified electronic signatures on documents, and exchange these secur…
Cognitive Worlds operates at the intersection of advanced software development and strategic cybersecurity consultancy. We specialize in building the next gener…
ComSign has vast experience in providing digital signature and PKI solutions to any sized organizations
As a global media and tech company, Comcast reaches hundreds of millions of customers, viewers, and guests with world-class connectivity and platforms and belov…
We help companies build out technical infrastructure to support ecommerce, real time payments, or in a consultive or proof of concept capacity to build new, or…
Crypto4A Technologies Inc. develops and delivers quantum-safe hardware security modules designed to meet the highest standards of cryptographic security. Its fl…
We provide expert IT security consultancy services to protect your business from cyber threats. Contact us today for a comprehensive security assessment.
Cryptomathic's robust cryptographic solutions protect sensitive information from unauthorized access. Trusted by global organizations across all industries.
CyberSeQ™ - AI-powered post-quantum cryptography migration platform. Only solution combining CADI discovery with automated refactoring for enterprise PQC compli…
D
The Depository Trust and Clearing Corporation (DTCC) advances solutions that help markets grow and protect the security of the global financial system.
Decent Cybersecurity provides cutting-edge, quantum-resistant cybersecurity solutions.
Deloitte drives progress, helping clients become leaders. Deloitte invests in outstanding people of diverse talents and backgrounds, empowering them to achieve…
Digitorus is a software development and consultancy company specialized in Public Key Infrastructure (PKI), Digital Signatures, and Trustworthy Systems (TWS) th…
An international software vendor fuelled by professional competence and pride in a Digital World, enhancing earnings from the global marketplace and enriching t…
The Dutch Ministry of Defence (NL-MoD) has created an internal publicly trusted CA certified according eIDAS. The only subscriber is the NL-MoD. All subjects ar…
E
ECAC, Government of Pakistan is a regulatory body for Certificate Service Providers
Entrust is dedicated to securing identities, data, and transactions around the globe
Eviden provides highly certified software and hardware cybersecurity products to support customers in protecting their data, managing access and securing identi…
ExeQuantum delivers end-to-end PQC migration, including cryptographic discovery & inventory, remediation, and maintenance
eMudhra, a Digital Trust Service Provider (TSP), specializes in delivering comprehensive digital security solutions and services. This role is pivotal in ensuri…
F
FEDLIN builds the controls a compliance platform only monitors — and runs them: SOC 2, NIST 800-53 Rev 5, and post-quantum key exchange.
Facti is a Brazilian nonprofit foundation dedicated to research, development, innovation, and capacity building in information and communication technologies. I…
Modernize data security for multi-cloud. Secure data at rest, in motion, or during use. On-premises, In the cloud. Or anywhere in-between.
At Frazer-Nash, we help organisations deliver innovative engineering, systems and technology solutions to make lives safe, secure, sustainable, and affordable.
G
GLA has emerged as one of the leading universities in India over the years that has been recognised by the UGC. Check out our infrastructure and education progr…
GuardedBox is a Spanish cybersecurity technology company focused on providing an innovative, advanced, certified and trusted online solution for universal and s…
I
For more than a century, IBM has been a global technology innovator, leading advances in AI, automation and hybrid cloud solutions that help businesses grow.
Eliminate password risks, streamline operations, and foster a secure, productive digital environment. Try Idenprotect now!
For nearly two decades, Inetum has been delivering Public Key Infrastructure (PKI) projects and services across Spain and the Americas. Additionally, we serve a…
The Information Network Security Administration was established for the first time in 1999 under the Council of Ministers Regulation No. 130/1999 with the aim o…
Dedicated to providing real-time cryptographic visibility and intelligence to secure your key management infrastructure across all environments.
i4p is a Hungarian company, who is first to offer secure multi-party cryptography (MPC) in the certified HSM. Their products are Common Criteria EAL4+ certified…
J
At JISA, we offer Aadhaar Data Vault Solution, HSM Security Solution, Data Security Solution, Encryption Key Management Solution, and many more.
Jefferies is the leading pure-play investment banking and capital markets firm, purpose-built and driven to deliver for our clients.
K
KHICS Consulting undertakes cybersecurity capability maturity assessments for clients. It relies on the outcomes to enable appropriate security capabilities for…
With passion, curiosity, creativity, and freedom, while firmly rooted in social responsibility, we contribute to the shaping of a sustainable and resilient futu…
Keyfactor develops products for PKI, digital signatures, cryptographic posture management, and cryptography
A shared, verifiable model of reality — identity, ownership, authority and history — for people, organisations and AI. The Reality Infrastructure for the human–…
At Kyndryl, we design, build, manage and modernize the mission-critical technology systems that the world depends on every day.
L
At Landis+Gyr, we create a greener tomorrow through leading smart metering, grid edge intelligence and smart infrastructure technology.
Loblaw Companies Limited is a Canadian retailer with corporate and franchised supermarkets under various banners, as well as pharmacies, banking, and apparel se…
M
Margins ID systems and Applications (MIDSA) is a company that provides IT solutions related to identity matters.
Methics provides software products for mobile signature solutions to operators and application providers. Methics offers carrier grade products to answer the ne…
Explore Microsoft products and services for your home or business. Shop Surface, Microsoft 365, Xbox, Windows, Azure, and more. Find downloads and get support.
N
Navy Federal Credit Union is an armed forces bank serving the Navy, Army, Marine Corps, Air Force, Space Force, Coast Guard, veterans, DoD & their families.
Nextwave (Thailand) is Thailand's Leading Cyber Security and Digital Transformation Software distributor in Thailand, with 20 years of experiences in the field…
NgKore is an open-source community driving innovation across Quantum Safe Network, Post-Quantum Cryptography (PQC), eBPF, 5G Advanced, 6G, O-RAN, NTN, AI/ML, Bl…
O
Applied cryptography research firm specializing in cryptographic protocol design, formal security analysis, and privacy-preserving technologies.
OmniTrust secures the connected world from silicon to AI through unified Trust Lifecycle Management across devices, identities, and cryptography.
P
Paraxiom Technologies Inc. is a Montréal company founded in 2023 that builds post-quantum transport infrastructure in pure Rust.
Quantum safe zero trust secure remote access for edge to anything. Patero cloaks Internet-exposed endpoints, reduces the network attack surface, and future-safe…
Delivering enterprise-grade smartcard personalization and printing services to government agencies and financial institutions requiring the highest security sta…
PostQ is a software platform focused on helping organizations understand, manage, and transition their cryptographic infrastructure to be resilient against futu…
Q
QClairvoyance is a deep-tech startup working on developing next-generation applications that leverage Post-Moore computing architectures, specifically in the fo…
Discovery, inventory and risk assessment platform. Qinsight provides visibility into cryptographic assets and risk, enabling migration to post-quantum cryptogra…
Provides post-quantum cryptographic solutions, compliant with NIST standards, to protect digital infrastructure from quantum computing threats.
QSE pioneers quantum-resilient encryption solutions to protect data for businesses, governments, and individuals ensuring a secure digital future
Qubit Guard delivers post quantum cryptography to defend against future quantum attacks. Strengthen enterprise security with quantum cybersecurity.
R
Specializing in Microsoft Entra Private Access, Windows Always On VPN, Microsoft DirectAccess, and Public Key Infrastructure (PKI).
S
SITG Consulting delivers board‑ready insights on quantum risk, resilience, and survival mandates. Read The Quantum Time Bomb and more. Transformation, Integrity…
SSL.com is a publicly-trusted commercial certificate authority expanding the boundaries of encryption and authentication relied upon by users worldwide.
SafeLogic provides validated & interoperable cryptography software that satisfies FIPS 140, CMMC v2.0, FedRAMP, and PQC requirements. Request consultation.
SafeCipher focuses on Public Key Infrastructure (PKI), Hardware Security Modules (HSM), and Quantum-Resistant Cryptography.
Our expertise spans Open Banking solutions, information security, and FinTech, particularly in the Finance/Banking & FSI, Government, Manufacturing, Telecommuni…
Securemetric is a company based in Kuala Lumpur, founded in 2007, with regional offices in Indonesia, Singapore, Vietnam, and the Philippines. We specialize in…
Discover advanced HSM-based cybersecurity solutions: XKS, BYOK, PKI, and more. Protect data, manage encryption keys, and prepare for the post-quantum era.
SeguriData is a Mexican technology company specializing in Public Key Infrastructure (PKI), digital signatures, digital identity, and data protection
Shree Ojas system and techinfra Pvt Ltd is major PKI consultant and hardware, software integration company in India.
Sixscape is dedicated to making Cryptographic Authentication and Secure Messaging Simple, to enable secure digital transformation, IoT deployment and allow 5G t…
Standard Chartered Bank offers personalized banking solutions for your needs. From savings deposits, credit cards, loans, investments & more.
T
TWCA is a leading independent certification authority technology company in Taiwan. It develops, licenses, supports, and sells certificate service, SSL, PKI sec…
TCS, a global leader in IT services, consulting, and business solutions, leverages technology for business transformation and helps catalyze change.
Leading IT distributor & solutions aggregator across Asia Pacific. Serving 22,000+ partners with enterprise technology distribution & enablement.
TechExcel bridges the gap between product development and service/support with a unified platform for ALM, ITSM and customer support.
We're working with leading PQC experts to provide software for PQC migrations.
The University of Bamenda (UBa) is a distinctive anglo-saxon university with future international reputation for higher standards of achievements and innovation…
Engineered for institutional scale. Tridecal orchestrates high-concurrency frameworks, Post-Quantum Cryptography to deliver resilient, sovereign ecosystems for…
Focused on building trust and security in the digital world, TrustAsia is dedicated to delivering sophisticated cybersecurity solutions for customers globally.
Custom development and code-level compliance auditing from a working engineer and standards author.
Tyche Institute is a non-profit research association in Tallinn, Estonia, working on AI governance, evidence, auditability, and open research.
U
Utimaco is a global platform solution provider of trusted Cybersecurity and Compliance solutions and services.
V
We offer Information Technology Solutions to the federal, state and local government as well as private businesses throughout the US.
VinCSS Internet Security Services JSC, established in 2018, is a leading company in the cybersecurity industry, driven by its mission to Pioneer For A Better Di…
W
Wells Fargo is a financial institution that operates its own private PKI and relies on many public PKI, with a strong interest in industry standards (e.g. ASC X…
Z
We are your trusted advisor for a high performing collaborative and connected supply chain. We help you maximise agility, traceability and visibility through a…
|
Introduction
By bringing together experts and stakeholders from across industries, the CM WG will act as a central forum of the PKI Consortium for addressing Cryptographic Module (CM) and Hardware Security Module (HSM) related topics. Through our collaborative efforts, we aim to improve interoperability between CMs, HSMs, foster the broader adoption of strong security practices, and ultimately enhance the resilience and trustworthiness of the global digital infrastructure.
Scope
The scope of this working group is to provide a comprehensive platform for discussing Cryptographic Module (CM) and Hardware Security Module (HSM) related topics, for identifying missing, but desirable and also problematic issues and for developing and modifying standards, solutions, suggestions, workarounds, testing environments and certification means for those issues.
Objectives and Goals
The objectives and goals of the Cryptographic Module Working Group are to:
- Address general cryptographic module related topics and challenges,
- Coordinate the development of practical and secure solutions to problems on its working plan,
- Foster the development of certification programs to formally validate interoperability among implementations,
- Develop test suites, reference architectures, and interoperability guidelines for crypto module interactions,
- Produce advisory documents, including migration guides, risk assessments, and implementation templates for member use,
- Enhance the overall security and integrity of digital communications and transactions.
The working plan of the working group defines the exact objectives to be reached, the success criteria, the deliverables and the planned due dates. The working plan shall be reviewed at least every six months and shall be accepted by the Members of the working group.
Means of Communication
A private mailing list is used for communication between Working Group Members. In the mail subjects the "[PKIC-CM]" prefix will be used.
Interested parties can contribute using the community discussions on GitHub, and Working Group Members will actively participate in those discussions.
Planning and action items are managed as issues within the same repository where the deliverables are published.
Membership and Participation
Organizations that are eligible to join this Working Group follow the membership process as described in the Bylaws of the PKIC, section “Membership”.
In accordance with the IPR policy, Members that choose to participate in this Working Group must declare their participation prior to participating by contacting the Chair of this Working Group.
The Chair of this Working Group must establish a list for declarations of participation and manage it in accordance with the PKIC Bylaws and the IPR policy and agreement.
Non-members can participate using the community discussions.
Decision Process
The decision process follows the Bylaws of the PKIC, with reference to sections “Voting” and “Working Group”.
All decisions in this Working Group shall be made by substantial consensus (as determined by the Working Group Chair) of all PKIC Members including interested parties. If substantial consensus cannot be reached (or upon the request of more than 25% of PKIC Members), the matter will be submitted for decision by the Executive Council.
Officers of the Working Group
The officers of the Working Group shall be a Chair and a Vice Chair (who will act as Chair when the Chair is absent). Each officer will be elected for a one (1) year term commencing on July 1 and may be elected to successive terms. Prior to election, the voting Member representatives will be asked who is interested in being elected to the positions. If there is only one candidate for an officer position, the election will occur by consensus. Otherwise, the election will be held by vote (one vote per Member). If there are only two candidates, then the candidate with the most votes wins. If there are more than two candidates, then there will be successive ballots (with the candidate with the fewest votes eliminated each time) until an officer is elected by at least 50% of the votes plus one vote.
IPR Policy
This Working Group is subject to the Intellectual Property Rights Agreement, Code of Conduct, and Bylaws of the PKIC, including the Antitrust Policy.
Antitrust Policy
In accordance with the PKIC antitrust policy, as stated by the PKIC Bylaws, an antitrust statement should be applied and read at the start of all Working Group meetings, in substantially the form written in PKIC Bylaws, chapter “Antitrust Policy”.
Other Applicable Policies
Any relevant PKIC policies defined by the Bylaws must be followed if not specifically excluded by this Working Group Charter.
Amendments to the Charter
This Charter may be amended by a two-third (⅔) vote of the Members of the Working Group.
