How QorTrace's methodology maps to the NIST post-quantum standards.
NIST finalised the first three post-quantum standards in August 2024. Every QorTrace audit and certificate explicitly cites compliance against them.
The three standards
| FIPS | Algorithm (former name) | Use case |
|---|---|---|
| FIPS 203 | ML-KEM (CRYSTALS-Kyber) | Key encapsulation — replaces RSA-OAEP, ECDH key agreement |
| FIPS 204 | ML-DSA (CRYSTALS-Dilithium) | Digital signatures — replaces ECDSA, RSA-PSS |
| FIPS 205 | SLH-DSA (SPHINCS+) | Stateless hash-based signatures — replaces ECDSA where size > performance |
A fourth, FIPS 206 (FN-DSA / Falcon), is in draft. We track it but don't yet score against it.
What "alignment" means in our reports
Every audit we issue includes a section called PQC Migration Readiness that scores your contract against:
- Signature scheme — does the contract use ECDSA, ED25519, or a hash-protected scheme?
- Migration path — how many breaking changes does the move to ML-DSA / SLH-DSA require?
- Forward secrecy — does any sensitive material rotate at a frequency safe against HNDL?
- Algorithm agility — can your contract swap signature schemes without redeployment?
Each gets a Critical / High / Moderate / Low rating that maps directly to a remediation step.
CNSA 2.0 (NSA, not NIST)
The NSA's Commercial National Security Algorithm 2.0 mandates:
- 2030: New systems for federal use must be PQC-ready
- 2035: All federal systems must have completed migration
We score against CNSA 2.0 timelines on every Atlas wallet. The countdown ticker in your Atlas dashboard isn't decorative — it's calibrated against the CNSA 2.0 cutover date.
EU DORA & UK FCA
DORA (in force from January 2025) requires regulated EU financial entities to:
- Maintain an inventory of cryptographic primitives
- Demonstrate a migration roadmap to "quantum-resistant" alternatives
- Test resilience annually
QorTrace's Atlas inventory + signed audit reports are designed to be droppable into a DORA evidence pack with zero rework.
How to cite us
In your compliance evidence, paste the audit URL and the methodology version:
"Smart contract audited under QorTrace methodology
qortrace-method-v0.2, scoring NIST FIPS 203 / 204 / 205 alignment as Compliant for ML-DSA primitives. See verifying URL: https://qortrace.com/verify/{audit_id}"
Reviewers (SOC 2, ISO 27001, DORA) will recognise the structure — we drafted it with them in mind.
Want a stamped receipt?
Generate a methodology receipt PDF at /methodology/receipt/{audit_id}. It's separately signed and includes a hash chain reviewers can paste into their workpapers. See Verifying an audit certificate.