Canadian cybersecurity developer Crypto4A Technologies Inc. has received NIST FIPS 140-3 Level 3 validation for QASM™, the core cryptographic module integrated into its QxHSM™ hardware security module platform. Supporting the full suite of NIST-standardized Post-Quantum Cryptography (PQC) algorithms, the certification marks the first time a quantum-safe HSM has achieved Level 3 security validation under the updated FIPS 140-3 standard.
[ Crypto4A Validated Hardware Security Architecture ]
│
┌─────────────────────────────────────┼─────────────────────────────────────┐
▼ ▼ ▼
FIPS 140-3 Level 3 Validation NIST PQC Algorithm Support Root-of-Trust Applications
• Independent NIST Certification. • ML-KEM (FIPS 203 Key Exchange). • Post-Quantum PKI & Signing.
• Physical Tamper Response. • ML-DSA (FIPS 204 Digital Signatures). • Sovereign Secrets Vault (QxVault™).
• Identity-Based Authentication. • SLH-DSA (FIPS 205 Stateful Hash). • Defense, Finance & Grid Infrastructure.PQC Algorithm Integration and Physical Hardware Assurance
Hardware Security Modules (HSMs) generate, store, and manage the underlying cryptographic keys that anchor digital identity, financial transactions, and secure communications. Under FIPS 140-3 Level 3, hardware modules must demonstrate strong identity-based authentication, logical separation of key management, and zeroization when physical tampering is detected:
- Full NIST PQC Standard Support: The QASM™ module natively executes NIST-standardized algorithms—including ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205)—alongside stateful hash-based signature schemes like LMS.
- Crypto-Agile Architecture: The QxHSM™ and QxVault™ platforms allow enterprise and government customers to migrate legacy classical algorithms (RSA/ECC) to post-quantum keys without replacing underlying physical appliances or disrupting live operations.
- Validation Partner Integration: DigiCert has partnered with Crypto4A to integrate the validated module into its DigiCert ONE platform, securing high-assurance digital signing, certificate issuance, and automated PKI infrastructure against “harvest now, decrypt later” threats.
Led by CEO and co-founder Bruno Couillard, the Ottawa-based company provides an immediately deployable, independently validated hardware root-of-trust for governments, defense organizations, and critical infrastructure operators preparing for mandatory post-quantum migration deadlines.
Review the announcement via Crypto4A Pressroom here.
August 20, 2026