HSM供應商：認證狀態與PQC合規狀態

本報告考察了全球硬體安全模組 (HSM) 供應商的競爭格局，總結了 FIPS 140-3 3 級 CMVP 認證的現狀、待處理的 CMVP 審核的現狀、PQC 演算法支援的比較分析以及主要供應商的生態系統。

實際益處：

• 這樣，您就可以評估哪個硬體安全模組 (HSM) 供應商最適合短期和長期後量子密碼 (PQC) 部署。
• 我們可以協助進行供應商選擇、採購和產品藍圖制定，同時考慮 FIPS 140-3 3 級認證狀態和 CMVP（加密模組檢驗程序）審核計畫。
• 您可以預見與認證取得延遲和 PQC 過渡要求相關的監管和合規風險。
• 透過比較現有主要 HSM 供應商和專業供應商的商業 PQC 支援狀況，您可以利用此資訊制定系統遷移和升級策略。

主要問題解答：

• 哪些 HSM 供應商已經獲得 FIPS 140-3 3 級 CMVP 認證，哪些供應商仍在審核中？
• CMVP審核的等待時間是多久？何時可以預期會有改進？
• 哪些供應商已獲得美國國家標準與技術研究院 (NIST) 的密碼演算法檢驗計畫 (CAVP) 的認證，認證標準為 PQC 演算法 (FIPS 203、204、205、SP 800-208)？
• 目前整個 HSM 產品線在多大程度上可提供商業 PQC 支援？
• 哪些廠商在其架構中採用了“量子安全設計”，哪些廠商則採用了逐步式或混合式方法？

研究亮點：

• 追蹤主要 HSM 供應商的狀態，了解他們是否已獲得、正在接受審核或即將獲得 FIPS 140-3 3 級 CMVP 認證。
• 對 CMVP 審查等待狀態、導致審查延遲的因素以及 NIST 的「零隊列」計劃（旨在到 2026 年中期改進的一項舉措）的考慮進行了分析。
• PQC 演算法支援的詳細比較：ML-KEM（基於模組格的金鑰封裝機制）、ML-DSA（基於模組格的數位簽章演算法）、SLH-DSA（無狀態雜湊數位簽章演算法）、LMS/XMSS（Leighton-Micali 簽章/擴充 Merkle 簽章方案）以及 Falcon 等新興演算法。
• 評估成熟大型企業和利基創新者的商業韌體和產品的 PQC 合規性狀態。
• 詳細介紹供應商架構和生態系統，重點在於抗量子信任基礎、生命週期管理以及未來藍圖中的差異化因素。

目錄

主要發現

FIPS 140-3 CMVP 認證等待期

取得 FIPS 140-3 3 級 CMVP 認證的狀態

主要預測

NIST CAVP認證狀態（FIPS 203、204、205、SP 800-208）

商業PQC支援的現狀

主要供應商生態系統

專業供應商

Actionable Benefits:

• Assess which Hardware Security Module (HSM) vendors are best positioned for near-term and long-term Post-Quantum Cryptography (PQC) adoption.
• Inform vendor selection, procurement, and roadmap planning based on Federal Information Processing Standards (FIPS) 140-3 Level 3 certification status and Cryptographic Module Validation Program (CMVP) timelines.
• Anticipate regulatory and compliance risks related to delayed certification and PQC transition requirements.
• Benchmark commercial PQC readiness across incumbent and niche HSM vendors to guide migration and upgrade strategies.

Critical Questions Answered:

• Which HSM vendors have already achieved FIPS 140-3 Level 3 CMVP certification, and which are still in progress?
• How long are CMVP queue times, and when are improvements expected?
• Which vendors have achieved National Institute of Standards and Technology (NIST) Cryptographic Algorithm Validation Program (CAVP) certification for standardized PQC algorithms (FIPS 203, 204, 205, SP 800-208)?
• How mature is commercial PQC support across current HSM product lines?
• Which vendors are architecturally quantum-safe-by-design, and which rely on incremental or hybrid approaches?

Research Highlights:

• Tracking of FIPS 140-3 Level 3 CMVP status across major HSM vendors, including obtained, in-process, and imminent certifications.
• Analysis of CMVP queue dynamics, including causes of delays and NIST’s “Queue Zero” plan targeting mid-2026 improvements.
• Detailed comparison of PQC algorithm support, including Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), Module-Lattice-Based Digital Signature Algorithm (ML-DSA), Stateless Hash-Based Digital Signature Algorithm (SLH-DSA), Leighton-Micali Signatures-eXtended Merkle Signature Scheme (LMS/XMSS), and emerging options such as Falcon.
• Evaluation of commercial firmware and product readiness for PQC across incumbent leaders and niche innovators.
• In-depth profiles of vendor architectures and ecosystems, highlighting differentiation in quantum-safe roots of trust, lifecycle management, and future roadmaps.

Who Should Read This?

• Chief Information Security Officers (CISOs) and cryptography leaders planning PQC transition strategies.
• Security architects and compliance teams responsible for FIPS, NIST, and industry certification alignment.
• Procurement and vendor management teams evaluating HSM platforms for government, financial services, cloud, and critical infrastructure deployments.
• HSM vendors, cloud providers, and Managed Security Service Providers (MSSPs) tracking competitive positioning and roadmap benchmarks.
• Regulators and policymakers assessing ecosystem readiness for post-quantum cybersecurity mandates.

TABLE OF CONTENTS

Key Findings

FIPS 140-3 CMVP Queue Times

FIPS 140-3 Level 3 CMVP Status

Key Forecasts

NIST CAVP Status FIPS 203 204 205 SP 800-208

State of Commercial PQC Support

Key Vendor Ecosystem

Niche Players