Algorithm correctness & standards conformance
Does the implementation actually compute the standardised algorithm correctly, against whichever standard it claims conformance to?
Requirements, evidence source, and references
This page is the citable form of this dimension — a finding elsewhere can link straight to the bar it was judged against.
Algorithm correctness & standards conformance
Conformance gate6 requirementsDoes the implementation actually compute the standardised algorithm correctly, against whichever standard it claims conformance to?
Failing known-answer tests against the standard it claims, or still shipping pre-final parameter sets past a stated deadline, results in Underperform regardless of how the vendor scores on every other dimension.
Passes known-answer tests and test vectors for the final standardised parameter sets.
ML-KEM keygen, encapsulation and decapsulation against FIPS 203 vectors.
ML-DSA keygen, sign and verify against FIPS 204 vectors.
SLH-DSA sign and verify against FIPS 205 vectors, where the vendor claims support.
Decapsulation on a malformed or adversarial ciphertext fails closed, rather than returning a usable shared secret.
- NIST FIPS 203 — Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)confirmed2026-08-13Published 2024-08-13. Parameter sets ML-KEM-512 / 768 / 1024.
- NIST FIPS 204 — Module-Lattice-Based Digital Signature Standard (ML-DSA)confirmed2026-08-13Published 2024-08-13.
- NIST FIPS 205 — Stateless Hash-Based Digital Signature Standard (SLH-DSA)confirmed2026-08-13Published 2024-08-13. Based on SPHINCS+.
Ships the final standardised parameter sets — not draft or round-3 Kyber / Dilithium naming and parameters.
Marketing and documentation use the standardised names, so a buyer can tell which is implemented.
Where a pre-final implementation is still shipped for compatibility, it is labelled as such rather than presented as conformant.
- NIST FIPS 203 — Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)confirmed2026-08-13Published 2024-08-13. Parameter sets ML-KEM-512 / 768 / 1024.
- NIST FIPS 204 — Module-Lattice-Based Digital Signature Standard (ML-DSA)confirmed2026-08-13Published 2024-08-13.
A conformance claim against a non-NIST national standard is checked against that body's own published document, never silently mapped onto NIST's.
- BSI TR-02102-1 — Cryptographic Mechanisms: Recommendations and Key Lengthsconfirmed2026-08-12Version 2026-01, dated 23 Jan 2026. Germany's recommendation set.
- ANSSI views on the Post-Quantum Cryptography transition (2023 follow-up)confirmed2026-08-12France's position. Notably requires hybridisation where PQ protection is relevant.
- NSA Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)search-corroborated2026-08-12Direct PDF read was blocked (HTTP 403) when last attempted; contents corroborated across secondary sources only. Do not upgrade without reading the primary.
- Other national PQC programmes (e.g. South Korea KpqC, Japan CRYPTREC)unverifiedNamed as leads only — neither programme's published standard has been checked by this project. A conformance claim against either must be verified against that body's own document before it is scored, never mapped onto NIST's.
Algorithm identifiers and OIDs match the standard the vendor claims.
PKI / CATLS / networkHSMCertificate and protocol encodings use the registered identifiers, not vendor-private ones.
Where a vendor-private identifier is unavoidable, it is documented and its scope stated.
Algorithm-level validation by an external programme, where one exists for the algorithm in question.
HSMLibrary / SDK- NIST Automated Cryptographic Validation Protocol (ACVP) / CAVP algorithm testingsearch-corroboratedThe algorithm-level validation programme that sits beneath module validation. Primary programme text not read in the session that recorded this entry.
Any deviation from standardised parameters is disclosed by the vendor rather than discovered by a reviewer.
- NIST FIPS 203 — Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)confirmed2026-08-13Published 2024-08-13. Parameter sets ML-KEM-512 / 768 / 1024.
- NIST FIPS 204 — Module-Lattice-Based Digital Signature Standard (ML-DSA)confirmed2026-08-13Published 2024-08-13.
- NIST FIPS 205 — Stateless Hash-Based Digital Signature Standard (SLH-DSA)confirmed2026-08-13Published 2024-08-13. Based on SPHINCS+.
- BSI TR-02102-1 — Cryptographic Mechanisms: Recommendations and Key Lengthsconfirmed2026-08-12Version 2026-01, dated 23 Jan 2026. Germany's recommendation set.
- ANSSI views on the Post-Quantum Cryptography transition (2023 follow-up)confirmed2026-08-12France's position. Notably requires hybridisation where PQ protection is relevant.
- Other national PQC programmes (e.g. South Korea KpqC, Japan CRYPTREC)unverifiedNamed as leads only — neither programme's published standard has been checked by this project. A conformance claim against either must be verified against that body's own document before it is scored, never mapped onto NIST's.