Announcing Chainguard’s industry-first validated FIPS 140-3 module delivering post-quantum readiness
- View all articles
Zayn Lohit
Senior Product Manager
Chainguard
- View all articles
Katie Campisi
Staff Product Marketing Manager
Chainguard
Zayn Lohit Senior Product Manager + 1 other
Today, we are announcing that the Chainguard FIPS Provider for OpenSSL v3.6 has received validation from the NIST Cryptographic Module Validation Program (CMVP) under the FIPS 140-3 standard (Certificate #5523).
This makes Chainguard the first and only provider to deliver an approved hybrid post-quantum key exchange as a validated service inside a FIPS 140-3 module.
With the Commercial National Security Algorithm Suite (CNSA) 2.0 requiring post-quantum algorithm support starting in January 2027, organizations governed by federal and international compliance frameworks, including FedRAMP, EO 14409, DORA, PCI DSS v4.0, and the CRA, will no longer have to navigate impossible tradeoffs. Chainguard gives you immediate, out-of-the-box post-quantum compliance, zero known CVEs, and strict FIPS validation.
Eliminate the tradeoff between FIPS compliance and quantum readiness
For engineering, security, and compliance teams in regulated sectors, managing cryptographic foundations has historically required tough trade-offs:
Meeting FIPS 140-3 requires strict algorithmic verification, often locking teams into legacy cryptographic modules.
Revalidating cryptographic modules at NIST takes time, which often leaves organizations forced to run outdated modules with accumulated CVEs.
The US government's CNSA 2.0 directive sets a hard January 2027 deadline for adopting quantum-safe algorithms to protect against "harvest-now, decrypt-later" attacks.
Adopting post-quantum cryptography (PQC) used to mean stepping outside of FIPS-approved boundaries or undertaking massive, risky infrastructure redesigns. Chainguard FIPS Provider for OpenSSL v3.6 solves this dilemma by delivering a drop-in upgrade that combines government-validated post-quantum key exchange with zero-CVE guarantees.
Chainguard delivers out-of-the-box post-quantum compliance
Chainguard owns the validated module and its lifecycle. We can submit security fixes, algorithm updates, and patch CVEs inside the validated boundary itself. This lets us carry the certificate forward, rather than waiting for an upstream module owner or deferring remediation to a future revalidation. In practice, that ownership gives customers durable advantages:
1. First Approved Hybrid Post-Quantum Key Exchange
Our OpenSSL v3.6 module is validated under NIST Certificate #5523 and covers all three standardized post-quantum TLS hybrids, which are approved FIPS services.
By combining proven classical key exchanges with post-quantum ML-KEM algorithms, hybrid key exchange lets you maintain current CNSA 1.0 regulatory compliance today while instantly shielding your workloads against future quantum threats. Chainguard enables you to achieve out-of-the-box PQC compliance that no other vendor can deliver under FIPS 140-3.
2. Full Post-Quantum & Classical Algorithm Coverage
The module supports the complete suite of standardized post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) alongside classical FIPS primitives like AES, SHA-2/3, ECDSA, and RSA. It also integrates a NIST-validated software entropy source (Cert E191) directly within the module boundary, ensuring full 256-bit cryptographic strength for every generated key.
3. Zero CVEs in the Module Boundary
Organizations shouldn't have to compromise safety for compliance. Rather than deferring vulnerability fixes to a future revalidation, the v3.6 validation bakes remediations for active high-profile CVEs directly into the module boundary, delivering zero known CVEs out of the box.
Rollout & availability
Beginning October 1, 2026, Chainguard will roll out the validated FIPS 3.6 module to our FIPS container images on an opt-in basis. Because adoption is opt-in, engineering teams can migrate workloads to quantum-safe hybrid key exchange on their own schedule without breaking existing applications or risking downtime.
To learn more about migrating your workloads to validated FIPS 3.6 images or preparing your organization for CNSA 2.0, reach out to our team.
Share this article
Related articles
- product
Announcing the Sovereign Artifacts beta
- product
Announcing Chainguard container images for Go 1.27
- product
Introducing the Guardener GitHub App
- product
Chainguard Libraries now available on AWS Security Hub Extended
- product
Everything we announced during AI Readiness Innovation Week
- product
Fewer CVEs, more accurate findings: Wiz now scans Chainguard Libraries for Python and Java