Define the system boundary before choosing the migration path.

Federal civilian and other non-NSS systems

OMB (Office of Management and Budget) memorandum M-26-15 addresses prioritized PQC (post-quantum cryptography: encryption designed to resist future quantum computers) migration, inventory and phased planning, and expressly excludes national security systems. Applicability follows the system scope, not merely the department’s name. Read the memorandum.

A proposed engagement identifies one path, evaluates compatibility and produces agreed test observations and limitations. Our CBOM (cryptographic bill of materials: an inventory of where encryption is used) prototype and unvalidated OSCAL (a machine-readable format for compliance documents) drafts are not a substitute for the agency’s inventory, migration plan or authorization process.

Defense and national security systems

The private cnsa2 profile (a set of algorithms in the private Core software) uses ML-KEM-1024 (quantum-resistant key exchange), ML-DSA-87 (quantum-resistant signatures) and AES-256-GCM (standard data encryption) with hybrid X25519 (classical key exchange) key establishment by default. It has developer-test evidence. This does not establish NSA approval, CNSA qualification, CSfC listing, FIPS module validation or suitability for classified use. Requirements and assessment must be established for each program.

Potential communications-hardening evaluation

A proposed test can examine authorized peer connections, direct versus gateway (an intermediate connection point) behavior, loss/reconnect scenarios and deployment constraints in a non-operational environment. NAT traversal (connecting through network address translation) is not evidence of anti-jam capability, tactical radio compatibility, low observability or operation without an underlying network.

FRA (Federal Railroad Administration) rail research

Rail use remains a proposed research evaluation of selected communication paths. No field deployment, signaling certification, safety integrity level or rail safety improvement has been demonstrated by the cited lab work. Operational interfaces and safety constraints require sponsor and system-owner approval.

Proposal evidence

Use the dated capability register to distinguish implemented code, founder-reported connectivity, prototype artifacts and roadmap services. Historical build results do not establish the current profile in a delivered binary.