Post-quantum cryptography audit checklist
Direct answerWhat a post-quantum cryptography audit must cover: specification conformance to FIPS 203/204/205, input validation, constant-time behavior, hedged signing, hybrid combiners, stateful-signature state management, and crypto-agility.
Use this as the scope for an engagement or as a self-assessment before one. Items are grouped by the failure class they prevent.
Specification conformance
- Implements the final FIPS 203/204/205 (2024-08-13) or SP 800-208, not a pre-standard round submission
- Passes the NIST ACVP / CAVP known-answer tests for every parameter set shipped
- Domain-separation bytes, context strings, and pre-hash variants match the standard exactly
Input validation
- ML-KEM: modulus check on encapsulation keys, hash check on decapsulation keys, length checks on ciphertexts
- ML-DSA / SLH-DSA: bounds checks on all decoded signature components; reject malformed encodings before any secret operation
- Stateful signatures: verifier validates parameter identifiers and index ranges
Side channels
- No secret-dependent branches, memory accesses, or variable-time arithmetic (division, modular reduction, floating point)
- Rejection-sampling loops do not leak secret-correlated information
- Verified with tooling (for example ctgrind, dudect, or formal methods), not by inspection alone
Randomness and hedging
- Fresh seeds from an approved DRBG for every key generation and encapsulation
- ML-DSA and SLH-DSA use hedged signing unless there is a documented reason for deterministic mode
- Fault-attack countermeasures where deterministic signing or hash-based signing is used
Protocol integration
- Hybrid combiners bind both shared secrets and both ciphertexts (RFC 10024, SP 800-227)
- Key-share encoding order matches the named group definition
- Downgrade and negotiation paths cannot silently drop the post-quantum component
- Stateful signature state is persisted atomically, never cloned, and survives crash and restore
Crypto-agility and operations
- Algorithm identifiers are negotiated or versioned so a future switch (for example to HQC or FN-DSA) does not require a protocol redesign
- Key and signature sizes are accounted for in storage, MTU, and DoS budgets
- Documented migration plan aligned to the NIST IR 8547, CNSA 2.0, EU, or UK NCSC timeline that applies
Firms that perform these audits
zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec