CryptoComply 140-3 FIPS Provider with PQC Submitted to CMVP

SafeLogic’s CryptoComply 140-3 FIPS Provider with PQC is the next generation of our OpenSSL-compatible FIPS module, designed to support modern post-quantum and hybrid cryptographic deployments. As I shared previously, the algorithms for this module are CAVP validated under ACVP certificate #A8228.

We’re excited to share that this module has successfully completed the lab evaluation phase of FIPS 140-3 validation and was submitted to the CMVP on May 19, 2026!

The module is now in the CMVP queue. It is also listed on the CMVP Modules in Process (MIP) List, where its validation status can be tracked publicly.

Over the last year, the CMVP has continued to focus on reducing validation backlog timelines, and we’ve seen significant and reliable progress on this front. Based on the CMVP’s current efforts to reduce the backlog, we anticipate full FIPS validation of this module before the end of 2026!

This new version of the module introduces significant enhancements focused on post-quantum cryptography (PQC), crypto-agility, and hybrid use cases.

For organizations planning PQC transitions, having a FIPS module with integrated PQC support significantly reduces integration and compliance complexity. Rather than maintaining separate cryptographic implementations, teams can begin testing hybrid and post-quantum deployments within an existing FIPS-oriented architecture.

These improvements include adding:

• ML-KEM support for all NIST-approved parameter sets
• ML-DSA support for all NIST-approved parameter sets
• SLH-DSA support for all NIST-approved parameter sets
• LMS signature verification support for all NIST-approved parameter sets
• Entropy provided by ESV-validated (#E241) CryptoComply Entropy Provider
• CNSA 2.0 mode, restricting access to only CNSA 2.0-aligned algorithms
• PQC mode, restricting access to only algorithms designed to resist cryptographically relevant quantum computers (CRQCs)
• Alignment with all the latest FIPS 140-3 requirements
• Support for the first FIPS-approved ML-KEM/EC hybrid implementations – stay tuned for an upcoming blog post with more details!

If you haven’t explored PQC algorithms yet, this is a great opportunity to start researching and integrating them. Get a short primer on how PQC and classical algorithms compare here.

To learn more about how you can leverage this new module now, please contact us.