top of page
SITG-CONSULTING
SITG-Consulting wax seal logo

Quantum Washing: Four Tells That a Post-Quantum Claim Is Marketing, Not Migration

Writer: Brian Couzens
Brian Couzens
2 days ago
9 min read
An image with the words describing the four tells of quantum washing

A deck landed on a chief information security officer’s desk last month. Quantum-safe today. Post-quantum ready. Aligned to the standards from the National Institute of Standards and Technology. Award-winning. Nothing in it had migrated a single key exchange.

That deck is not unusual. It is the template. Quantum washing is classical cryptography dressed in post-quantum language and sold to buyers who do not yet know which questions to ask. It is not always deliberate. Some vendors believe their own material. The effect on the buyer is the same either way: a board is told a risk has been addressed when it has been relabelled.

This article sets out the four tells that identify a washed claim, all of them visible in public records in under an hour, and the three questions that settle the matter in ten minutes. It is written for the people who have to sign off on vendor claims without being cryptographers: risk committees, audit committees, procurement leads and the board members who carry the fiduciary consequence when the claim turns out to be hollow.

What quantum washing is, and why it works

Green washing worked because buyers wanted to believe a product was sustainable and lacked the means to check. Quantum washing works for the same reason. Boards have been told, correctly, that a cryptographically relevant quantum computer will break the public-key algorithms that protect their data in transit, their signatures and their certificates. They have been told, correctly, that data harvested today can be decrypted later. They want the problem solved, and a vendor who says it is solved is telling them what they want to hear.

The gap the washer exploits is between two things that sound alike: protection that uses strong cryptography, and protection that has migrated to post-quantum cryptography. A product can do the first without doing any of the second, and the language of the first is easily stretched to imply the second.

What has actually changed in the last two years is specific and checkable. In August 2024, NIST published three post-quantum standards: FIPS 203, the module-lattice key encapsulation mechanism known as ML-KEM, for key establishment; FIPS 204, ML-DSA, for digital signatures; and FIPS 205, SLH-DSA, a stateless hash-based signature scheme. A further selection, HQC, followed in 2025 as a backup key encapsulation mechanism. These are the algorithms a migration moves to. If a claim does not name one of them, the claim is not about migration.

Tell one: a symmetric cipher doing the work

The commonest washed claim rests on AES-256. The vendor’s product encrypts data with a 256-bit symmetric cipher, the vendor notes that AES-256 is widely regarded as resistant to quantum attack, and the product becomes “quantum-safe today”.

The first half of that is true. Grover’s algorithm halves the effective key length of a symmetric cipher, and 256 bits halved is still beyond reach. The second half is where the washing happens. The symmetric cipher was never the exposure. What a cryptographically relevant quantum computer breaks is the public-key mathematics underneath: the key exchange that agreed the symmetric key in the first place, and the signatures that authenticated the parties. Harvest now, decrypt later is an attack on the key exchange. An adversary who records the traffic today and breaks the key agreement tomorrow has the AES key, and the strength of AES is then irrelevant.

So the test is simple. Ask what establishes the key. If the answer is RSA, elliptic-curve Diffie-Hellman or any other classical scheme, the product has a post-quantum cipher sitting on a pre-quantum key exchange, and the data it protects is harvestable. If the answer is ML-KEM, or a hybrid of ML-KEM with a classical scheme, the claim has substance. If the answer is a phrase like “quantum-derived key material” or “multi-part key” with no standard named, you have found the tell.

Tell two: certificates cited without numbers

Vendor material loves certification badges. FIPS 140 validated. Common Criteria certified. The badges appear on slides, data sheets and partner portals, and they appear without certificate numbers, without dates and without the scope of what was validated.

Every FIPS 140 validation is a public record on the NIST Cryptographic Module Validation Program register. Every Common Criteria certification is a public record on the Common Criteria portal. Both records carry a certificate number, a validation date, a sunset or expiry date, and a list of the approved algorithms inside the validated boundary. Pulling them takes minutes.

What the records reveal, repeatedly, is one of three things. The certificate has lapsed, expired or been moved to the historical list, and the vendor’s channel material has not caught up. The certificate is current but covers a small library inside the product, not the product itself. Or the certificate is current and covers the product, but the approved algorithm list contains no post-quantum algorithm at all, which means the validated cryptography is entirely classical and the post-quantum claim lives somewhere outside the boundary that was tested.

The last case matters more than it looks. A validated boundary is the only part of a product an independent laboratory has examined. A post-quantum algorithm running outside that boundary may be a correct implementation, or it may not be, and no one outside the vendor has checked. “FIPS validated” and “post-quantum” are then two true statements about two different parts of the product, placed side by side so that the reader joins them.

SITG-Consulting tracks this in its FIPS 140-3 thematic review, which maintains a register of validated modules that carry post-quantum algorithms inside the boundary. The register is short. Any vendor claiming validated post-quantum cryptography should be on it, by certificate number, or should be able to say when they will be.

Tell three: awards presented as validation

The third tell is the analyst award. A vendor announces that it has received a global leadership recognition in post-quantum cryptography from a market research firm. The announcement describes an independent evaluation. The chief executive says the recognition validates what the company has been saying for years.

Analyst recognition programmes rest on interviews with the vendor, analysis of the vendor’s own material and secondary desk research. No product is tested. No certificate is examined. No cryptographic boundary is inspected. The published methodology of the larger programmes states this plainly, and some go further: the recipient licenses the award before it can be announced, paying a fee for the right to use the research findings in marketing. The award is issued at no cost. The right to tell anyone about it is not.

None of this makes the firm dishonest or the award worthless as a marketing asset. It makes the award irrelevant to the question of whether the cryptography has migrated. An award a vendor pays to publicise measures marketing budget. It does not measure key exchange. When a vendor leads with the award rather than the certificate, that choice tells you which one they would rather you looked at.

Tell four: scope reduction as the pitch

The fourth tell is the hardest to see, because it contains a true statement about a real problem.

The pitch runs like this. Post-quantum migration is a multi-year programme. Applications must be inventoried, libraries replaced, certificates reissued, hardware refreshed, suppliers chased. Meanwhile data is being harvested. Our product sits in the network path and encrypts everything passing through it, independent of the applications on either side. Deploy it now, shrink the scope of your post-quantum programme, and protect the data while the long migration proceeds.

The problem is real. The sequencing argument is reasonable. What the pitch does not say is what the product leaves untouched. Everything either side of the vendor’s enforcement points stays exactly as it was: the application’s own cryptography, the public-key infrastructure, the digital signatures, the data at rest, and every third-party dependency that was never routed through the product. The product protects a corridor. It does not migrate the estate.

A corridor can be a sensible compensating control, and a well-run programme may deploy one. The washing is in the word “shrink”. A compensating control does not reduce the scope of a migration. It buys time against one threat vector while the full scope remains. A board told that its post-quantum programme has been shrunk, when in fact a corridor has been added alongside an unchanged estate, has been misled about the size of the obligation it still carries. That misunderstanding surfaces later, at the worst time, when a regulator or an auditor asks for the cryptographic inventory and finds the migration never started.

This is the distinction SITG-Consulting draws in its governance-first approach to post-quantum transformation: discovery, ownership and dependency mapping come first, because a control you cannot place against an inventory is a control whose coverage you cannot state.

The ten-minute test

Three questions, put to the vendor in writing, settle every one of the four tells.

Which NIST post-quantum algorithm, by name? The answer is ML-KEM, ML-DSA, SLH-DSA or HQC, with the parameter set and the function it performs. Anything else is a description of classical cryptography.

Which certificate, by number? The answer is a FIPS 140-3 certificate number on the NIST register or a Common Criteria certificate identifier on the portal, current, with the product name matching the one being sold.

Is that algorithm inside the validated boundary? The answer is yes, with the algorithm visible on the certificate’s approved list, or no, with an honest statement that the post-quantum implementation has not been independently tested.

Three answers or three evasions. Either way, the buyer knows what they are holding. A vendor with a real migration answers in a paragraph. A vendor without one produces a deck.

What this means for the board

The fiduciary point is not that boards should become cryptographers. It is that a board’s quantum risk position is a statement of fact it will be held to, and that statement is only as good as the evidence under it.

Regulators are moving from guidance to obligation. The European Union’s Digital Operational Resilience Act makes third-party technology risk a board matter. Prudential regulators in the United Kingdom and elsewhere require evidence that outsourced controls work, not vendor assurances that they do. Central banks in Asia are issuing technology risk directives with explicit cryptographic provisions. When the question arrives, “the vendor said it was quantum-safe” is not an answer, and “the vendor won an award” is a worse one.

The board’s protection is the same evidence the three questions produce: a named algorithm, a certificate number and a validated boundary, recorded in the cryptographic inventory against the asset the product protects. That record is what an auditor accepts, what a regulator recognises and what an insurer underwrites.

What independent validation does

Independent validation is not about catching vendors. It is about making sure the board’s quantum risk position rests on evidence rather than a deck.

SITG-Consulting’s Quantum Trust assurance services put vendor claims through exactly this process: the certificate records pulled and read, the validated boundary mapped against the product as sold, the key establishment traced end to end, and the compensating controls placed against the cryptographic inventory so that their coverage, and their gaps, are stated in writing. The output is a validation record the board can rely on and the vendor cannot argue with, because it is built from the vendor’s own public evidence.

For organisations earlier in the journey, the PQC readiness assessment establishes the inventory against which any vendor’s coverage claim must be measured, and the FIPS 140-3 gap analysis does for the organisation’s own modules what the three questions do for a vendor’s.

If your vendor cannot answer those three questions, that gap is the engagement. If your vendor can, you have a record worth keeping, and a vendor worth keeping too.

Frequently asked questions

Is AES-256 quantum-safe?

AES-256 is regarded as resistant to known quantum attacks because Grover’s algorithm only halves its effective key length. That does not make a product using AES-256 quantum-safe, because the key is established by public-key cryptography, and that is what a quantum computer breaks. Ask what establishes the key.

What is a validated boundary?

The part of a product that an accredited laboratory tested during FIPS 140 or Common Criteria validation. Its contents are listed on the certificate. Cryptography running outside the boundary has not been independently examined, whatever the vendor says about it.

Are analyst awards worthless?

They are marketing assets, and some are licensed by the recipient for a fee before they can be announced. They are not evidence of cryptographic migration, because no product is tested in the process of awarding them.

Is a network encryption product a bad idea?

No. It can be a sensible compensating control against harvest-now-decrypt-later exposure on specific traffic paths. It becomes a problem when it is sold or recorded as a migration, because the estate either side of it is unchanged.

What should I record once the vendor answers?

The algorithm, the certificate number, the validated boundary, and the assets the product covers, entered in the cryptographic inventory. That record is what satisfies an auditor or regulator. The vendor’s deck is not.

References

Comments

bottom of page