Post-Quantum Cryptography in STRATUM: PQC Meets FIPS 140-3

Post-quantum cryptography is becoming an infrastructure concern, not simply a cryptography-library feature. STRATUM supports the three NIST post-quantum standards that now define the baseline: FIPS 203 ML-KEM for key encapsulation, FIPS 204 ML-DSA for digital signatures, and FIPS 205 SLH-DSA for stateless hash-based signatures. Those algorithms address different parts of the problem. ML-KEM protects key establishment, while ML-DSA and SLH-DSA provide post-quantum signature paths.

There is an important compliance distinction behind that feature set. FIPS 203, 204, and 205 standardize the algorithms. FIPS 140-3 validates the cryptographic module that implements approved cryptography in a specific operating environment. STRATUM's core is written in Go, and our FIPS path uses the native Go Cryptographic Module rather than a separate C crypto shim. Go Cryptographic Module v1.0.0 is validated under CMVP certificate #5247 and CAVP certificate A6650, and that validated boundary includes ML-KEM. That gives STRATUM a validated post-quantum key-establishment primitive inside the same cryptographic module used by the Go control plane.

Go Cryptographic Module v1.26.0 moves that boundary forward again. It adds ML-DSA and is covered by CAVP certificate A8028. As of October 21, 2026, Go's current FIPS documentation still lists v1.26.0 as Pending Review in the CMVP process. Once that validation completes, STRATUM can advance the Go FIPS module and bring ML-DSA into the same CMVP-validated module boundary without redesigning the platform. STRATUM's SLH-DSA support remains a separate validation consideration because SLH-DSA is not part of the current validated Go v1.0.0 boundary and is not listed as part of the v1.26.0 Go module changes.

This is the model we want for infrastructure cryptography: crypto agility at the product layer, explicit algorithm provenance, and a validation boundary that can be upgraded as newer cryptographic modules complete CMVP. STRATUM can adopt post-quantum primitives without turning the whole control plane into a one-off crypto integration project every time the standards move forward.

The long-term goal is straightforward. Protect the Continuum with modern cryptography today, add post-quantum protection where it is appropriate, and keep the implementation anchored to validated modules as those validations become available. For regulated and mission environments, the details matter. The algorithm name matters, the module version matters, the certificate matters, and the operating environment matters. STRATUM is being built with that level of detail in mind.