Vista resources / Plain-English reference
How to evaluate PQC claims
When a vendor says “quantum-safe,” ask which cryptographic function is protected. A hybrid TLS key exchange can protect session keys while the certificate still uses a classical signature. Match the claim to an exact version, configuration and observation.
Use the claim as the start of a conversation
Technical terms often describe one property of a product. Before making a purchase or migration decision, connect the wording to a particular version, use case, operating mode, and evidence source. These prompts help you do that without assuming a claim is either complete or false.
On a narrow screen, scroll the table horizontally to read every column.
| Claim | Ask next | Useful evidence |
|---|---|---|
| Quantum-safe / quantum-resistant | Which threat, cryptographic function, algorithm, and configuration does the claim cover? | A precise claim with a product version and evidence. |
| PQC supported | Is support available in the shipped product, enabled in this deployment, and used by the intended clients? | Support matrix, configuration and observed negotiation. |
| Hybrid cryptography | Which classical and post-quantum mechanisms are combined, and in which protocol? | Named group or construction and interoperability results. |
| Crypto agile | What can be changed, by whom, and with what compatibility or operational limits? | A demonstrated change and rollback procedure. |
| NIST standardized | Which standard and parameter set is implemented? | Reference to the standard; implementation validation assessed separately. |
| FIPS validated | Which module certificate, version, environment, approved mode and algorithms apply? | The official CMVP record and security policy. |
| CNSA 2.0 aligned | Which applicable requirements are met by this version and use case? | Specific requirement mapping and supporting evidence. |
| CBOM included | What scope, collection method, time and dependencies does the file describe? | A usable artifact with provenance and known gaps. |
| AES-256 encrypted | How are keys agreed, distributed, authenticated, stored and rotated? | The surrounding cryptographic design, not only the symmetric cipher name. |
| Migration ready | Can we test the complete dependency chain and recover from a failed rollout? | A scoped pilot plan with owners, criteria and rollback. |
Worked example
Claim: “Our website uses quantum-safe encryption.”
More useful statement: “On a specified date, a test client negotiated X25519MLKEM768 with the public HTTPS endpoint. Authentication used a classical signature. The origin connection and other endpoints were not assessed.”
The second statement identifies an observation and its boundary. It allows an infrastructure owner to decide what to verify next. Use the website checker for a public handshake observation and the questionnaire for supplier evidence.