Cryptographic Standards
ML-KEM-768
Module-Lattice-Based Key-Encapsulation Mechanism. Replaces RSA and ECDH for quantum-safe key exchange. Implemented via liboqs (proxy) and quantcrypt.
ML-DSA-65
Module-Lattice-Based Digital Signature Algorithm. Replaces ECDSA for digital signatures. Currently implemented as HMAC-SHA256 proxy; full liboqs migration planned Q4 2026.
SLH-DSA-SHAKE-128f
Stateless Hash-Based Digital Signature Standard. Used for 313-BIND receipt signing and root of trust. Implemented via pyspx. Quantum-safe by design.
NIST SP 800-53 Rev 5
Estimated coverage: ~23% of the full Moderate baseline (31 documented / ~300+ required). The primary gap is documentation and governance, not technical security.
| Control Family | Status | Key Controls |
|---|---|---|
| AU — Audit & Accountability | EXCEEDS | AU-9, AU-10 via 313-BIND + SLH-DSA + IPFS |
| SC — System & Comms Protection | EXCEEDS | SC-12, SC-13 via FIPS 203/204/205 |
| SI — System & Info Integrity | EXCEEDS | SI-2: 2,858/2,4,107 tests · SDS=0 |
| AC — Access Control | PARTIAL | AC-2, AC-3, AC-6, AC-17 implemented |
| IA — Identification & Auth | PARTIAL | IA-2, IA-5, IA-7 implemented |
| AT — Awareness & Training | GAP | No formal training program — P1 priority |
| CA — Assessment & Authorization | GAP | No 3PAO engagement yet — P1 priority |
CMMC Level 2
Estimated coverage: ~38–45% of the 110 required practices across 14 domains. C3PAO third-party assessment is mandatory for Level 2 certification.
| Domain | Coverage | Gap |
|---|---|---|
| IR — Incident Response | 100% | IR-4, IR-5, IR-6 all implemented |
| AU — Audit & Accountability | ~56% | AU-1, AU-4–AU-8, AU-12 missing |
| SC — System & Comms | ~25% | SC-1, SC-2, SC-4, SC-5, SC-7 missing |
| AC — Access Control | ~23% | 17 of 22 practices missing |
| AT — Awareness & Training | 0% | All 3 practices missing — P1 |
| MA — Maintenance | 0% | All 6 practices missing — P1 |
| MP — Media Protection | 0% | All 9 practices missing — P1 |
CRQC Patch Status
| Item | Status | Timeline |
|---|---|---|
| CRQC-001 plugin_signer.py (ECDSA → ML-DSA) | ✅ PATCHED | v4.0.0 |
| CRQC-002 temporal chain (SHA-256 → SHA3-512) | ✅ PATCHED | v4.0.0 |
| CRQC-003 cosign ECDSA → SLH-DSA | ✅ PATCHED | v4.0.0 |
| CRQC-007 crypto_store RSA → ML-KEM-768 | ✅ PATCHED | v4.0.0 |
| CRQC-012 pyspx SLH-DSA fallback | ✅ PATCHED | v4.0.0 |
| CRQC-013 IPFS anchor signing | ✅ PATCHED | v4.0.0 |
| DW-1 liboqs real ML-DSA-65 implementation | 🔄 PLANNED | Q4 2026 |
| DW-2 HSM key storage migration | 🔄 PLANNED | Q1 2027 |
Privacy & Canadian Law
| Requirement | Status | Notes |
|---|---|---|
| PIPEDA (Canada) | ✅ COMPLIANT | Zero PII collected · Ottawa, ON jurisdiction |
| NSA CNSA 2.0 | ✅ ALIGNED | SLH-DSA deployed · ML-KEM-768 active |
| NIST IR 8547 | ✅ MIGRATED | RSA/ECC deprecated · PQC active |
| OWASP ASVS Level 2 | ~84% | Input validation, session security implemented |
| CIS Controls v8 IG2 | ~82% | Asset inventory, vulnerability management active |