PQSecure Partners with Carahsoft to Bring Post-Quantum Cryptography to Public Sector
PQSecure Technologies has selected Carahsoft as its distributor for post-quantum cryptography (PQC) products in the public sector, as announced by both companies on November 9. This agreement will enable U.S. government buyers to access PQSecure’s software libraries, hardware IP, and Root-of-Trust technologies through Carahsoft’s existing reseller network and purchasing contracts. The partnership focuses on improving procurement access rather than introducing new cryptographic developments.
Details of the PQSecure and Carahsoft Announcement
Under this agreement, Carahsoft will serve as PQSecure’s reseller to federal, state, and local government agencies. According to the announcement, PQSecure’s products will be available to buyers through The Interlocal Purchasing System, OMNIA Partners, and E&I Cooperative Services contracts.
The product portfolio Carahsoft will offer includes:
- Post-quantum cryptographic software libraries in C, Rust, and Assembly, compatible with ARM, RISC-V, and x86 architectures.
- Synthesizable cryptographic IP cores for FPGA, ASIC, and SoC platforms.
- Crypto-agile architecture, marketed as PQSecure-Agility.
- Root-of-Trust technology for secure boot, firmware authentication, and key management.
- Countermeasures against side-channel and fault-injection attacks, such as masking and constant-time operations.
PQSecure states that some of its implementations have received validation under the NIST Cryptographic Algorithm Validation Program (CAVP) and that PQSecure-Agility and PQSecure-Lib have been approved by the U.S. Department of War CIO ATLAS Program.
The Importance of Public-Sector Channels for PQC Migration
Government agencies planning to transition to quantum-resistant cryptography often face challenges in procuring the necessary tools, with contract vehicles frequently being a bottleneck. A distributor relationship like this streamlines the acquisition process. Carahsoft’s established presence within the government procurement system allows PQSecure to bypass the time-consuming process of building its own federal sales infrastructure.
Such partnerships are significant due to the pressing timelines for PQC migration. Regulated entities, including government bodies, typically adopt new technologies slowly and rely on a limited number of vendors, a trend also observed in financial sectors facing similar deadlines. A white paper from the Hong Kong Monetary Authority, as highlighted in QNews reporting on the city’s banks, candidly assessed the sector’s preparedness. Meanwhile, deployment tools in the broader field are advancing, evidenced by initiatives like Eigenkit’s release for algorithm deployment.
However, the announcement doesn’t specify which NIST standards the products implement, nor does it confirm alignment with FIPS 203, FIPS 204, or FIPS 205. There’s also no claim of FIPS 140-3 module validation. CAVP addresses algorithm correctness, which is distinct from a validated module. Details regarding contract terms, target agencies, and pricing were also not disclosed. Buyers will require these specifics to assess suitability.
For additional insights into PQC procurement and migration, continue reading QNews’ coverage of quantum security.