Prove your post-quantum crypto actually conforms
Migrating to ML-KEM, ML-DSA, or SLH-DSA is the easy part. Certification answers the load-bearing question your auditors and customers will ask: does the implementation you shipped actually follow FIPS 203/204/205, including the input checks the test vectors never touch?
What certification covers
A passing test-vector run is not conformance. We exercise the malformed-input and edge-case behaviour the vectors omit, and give you evidence you can defend.
- Conformance testing against FIPS 203, 204, and 205: the §7.2/§7.3 input validation and encoding behaviour, not just the known-answer vectors.
- Any implementation, any language, driven through a small stdin/stdout protocol, with no source access required.
- A signed conformance report you can hand to auditors, customers, and regulators.
- Re-testing on every release, so conformance is a continuous property, not a one-off certificate.
A certification you can verify, signed post-quantum
Every certification is issued as an attestation: a record of the reviewed posture, signed with a post-quantum signature (ML-DSA, FIPS 204) inside a FIPS 140-3 hardware security module, and written to a public transparency ledger. Anyone can check it without trusting us: verify the signature against our published key, then re-run the scan to reproduce the evidence hash.
- Signed with ML-DSA in AWS KMS: the key never leaves the HSM, and the signature survives a quantum adversary.
- Bound to a deterministic evidence report, so the score is reproducible, not asserted.
- Chained to an offline root key and logged in an append-only, timestamp-anchored ledger.
- Independently checkable offline against public files, with a reference verifier.
Related reading
Frequently asked questions
What does certification prove?
That a shipped ML-KEM, ML-DSA, or SLH-DSA implementation actually conforms to FIPS 203, 204, and 205, including the input-validation and encoding behaviour that known-answer test vectors never exercise.
How is it different from passing test vectors?
Known-answer vectors check the happy path. Certification also tests the input checks in the standards' sections 7.2 and 7.3, where real implementations tend to diverge.
Do you need our source code?
No. Any implementation, in any language, is driven through a small stdin and stdout protocol, so no source access is required.
What do we receive?
A signed conformance report you can show auditors, customers, and regulators.
Is certification a one-time thing?
No. Conformance is a continuous property, not a one-off certificate, so we re-test on every release.
What runs the tests?
The Sieve conformance battery, part of our open-source toolkit.
Turn quantum risk into a credential.
Book a discovery call and get an indicative scope and pricing for your organisation.