When NIST published ML-KEM, formerly CRYSTALS-Kyber, as its main post-quantum standard for establishing encryption keys in August 2024, the agency wrote, “At present, ML-KEM is believed to be secure, even against adversaries who possess a quantum computer.” In October 2025, Cy4Data Labs, a data-security company, announced what it called “the World’s First Quantum-Proof Encryption,” built on “a proprietary algorithm” that it did not name.
Four patterns recur in quantum and post-quantum security marketing, and a buyer can test each one against a public standard, a certificate, an agency assessment, or a published proof.
The four patterns are absolute promises, theorems cited without their conditions, “quantum” in a product’s name, and post-quantum labels without an algorithm or a certificate.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is the founder and CEO of Applied Quantum, a quantum systems integration and consulting firm, and the author of its PQC Migration Framework.
Absolute promises
Cy4Data called its Cy4Secure product “the industry’s first true quantum-proof encryption solution” and wrote that protected data, “even if stolen,” is “unreadable, unbreakable.” In a December 2025 release, the company wrote that its encryption is “mathematically proven unbreakable, immune to quantum decryption capabilities.” In neither release did Cy4Data name an algorithm, a source for its keys, or an outside audit.
NIST and the Internet Engineering Task Force (IETF), which write post-quantum standards, make no such promise. In RFC 9794, a terminology document published in June 2025, the IETF wrote that “it should not be assumed that an algorithm will not be compromised just because it is designed to provide post-quantum cryptography.”
On October 1, 2026, Germany’s Federal Office for Information Security (BSI) changed its advice on one such algorithm. It wrote that Classic McEliece, a post-quantum scheme in its guidelines since 2020, “should no longer be used for new developments.” Three research groups had estimated key-recovery costs below the scheme’s claimed security levels, as Quantum Observer reported. BSI wrote that the results “do not allow for a practical attack.”
Cy4Data also wrote that university research centers were “already announcing the ability to break traditional RSA encryption in seconds” and that Q-Day, the point at which quantum computers can break current encryption, “is already here.” It did not say which center had made such an announcement.
In September 2026, Stephen Weis of Anthropic factored RSA-896, the largest RSA challenge number factored as of November 12, using classical software on graphics processors for about 10 days. He wrote that the result “does not impact the security of deployed RSA-2048 keys.” NIST, NSA, and other agencies have set post-quantum deadlines without claiming that encryption is already broken.
A buyer can expect a complete description to name the algorithm, the standard, and the parameter set, one of the fixed configurations that a standard defines. NIST recommended ML-KEM-768 as the default parameter set for FIPS 203 in its final transition plan in October 2026.
Theorems without their conditions
Cy4Data wrote that it reached “true perfect secrecy” by re-engineering the one-time pad, “long regarded as mathematically unbreakable,” with a proprietary algorithm that “[g]enerates millions of one-time keys at digital scale without performance loss.”
Claude Shannon proved in 1949 that perfect secrecy needs at least as many possible keys as possible messages. A one-time pad meets that condition only with truly random keys as long as the data, used once and delivered in advance. Quantum Observer has explained why stretched or reused keys fall short of Shannon’s bound.
In its October release, Cy4Data did not say where the randomness in its keys comes from or how the keys reach “the authorized user’s device,” the only place it said decryption happens. If the keys meet Shannon’s conditions, no attacker can read the ciphertext, with a quantum computer or without one. If an algorithm stretches a shorter secret into them, the product is a stream cipher whose security depends on that unnamed algorithm.
In September 2026, Cy4Data announced an invitation-only challenge in which U.S. government and defense specialists would try to extract data protected by Cy4Secure. Quantum Observer found no published results by November 12.
The National Security Agency (NSA) has described a parallel pattern in quantum key distribution (QKD), in which two parties build a shared key from quantum states of light. Peter Shor and John Preskill proved in 2000 that BB84, the original QKD protocol, is secure under stated assumptions about the equipment. In a 2020 statement still on its website, NSA wrote that QKD vendors and the media “occasionally state bold claims based on theory,” among them that the technology offers “guaranteed” security based on the laws of physics.
On a page posted in October 2026, NSA again declined to recommend QKD for national security systems. “The actual security of a QKD system is limited by hardware and engineering designs rather than the unconditional security modelled by physics,” the agency wrote. In that text, NSA no longer named vendors and the media, Quantum Observer found when it compared the two versions.
Lars Lydersen and colleagues showed in 2010 that the detectors in two commercially available QKD systems “can be fully remote-controlled” with tailored bright light. They wrote that an attacker could then “tracelessly acquire the full secret key.” In September 2026, researchers led by Kejin Wei of Guangxi University reported that attenuators, the components that dim the light on chip-based QKD transmitters, emit infrared light that an eavesdropper could split off. In worst-case simulations in their preprint, they calculated that the leak could cut a standard link’s secure range from about 320 kilometers to 19.
A buyer can expect a complete description of a QKD product to name the protocol and the assumptions behind its security proof, and to list the implementation attacks the hardware has been tested against.
Quantum in the name
Financial regulators in Australia, Britain, and Denmark have warned investors about online trading platforms operating under the name “Quantum AI,” as Quantum Observer reported in its analysis of quantum washing.
A buyer offered an enterprise product with a quantum label can ask which component is quantum. For a quantum random number generator (QRNG), one document to ask for is a certificate from NIST’s Entropy Source Validation program, which tests a specific entropy source against NIST’s randomness standard and does not certify that the randomness is quantum in origin. NIST issued certificate E63 in August 2023 for ID Quantique’s Quantis QRNG chip, for example. A buyer can then ask what the quantum component changes, compared with a classical product with the same certificates.
Labels without an algorithm or certificate
NIST’s Cryptographic Module Validation Program (CMVP) validates cryptographic modules against FIPS 140-3, the federal security standard for such modules, and issues numbered certificates that list each module’s approved algorithms. CMVP issues no “quantum-safe” label. In its FAQ, CMVP wrote that “compliant” means a vendor “believes its product implementation meets the FIPS 140-3 requirements” but that the product “has not gone through the CMVP validation process.” The program told buyers to request the certificate number behind any claim of compliance, conformance, or certification.
CMVP has begun issuing such numbers to post-quantum modules. It issued certificate 5450 on July 29, 2026, to Thales Trusted Cyber Technologies for its Luna T7 hardware security module. The approved algorithms on that certificate include ML-KEM and ML-DSA, formerly CRYSTALS-Dilithium.
To check a post-quantum label against a standard, a buyer needs the algorithm’s name. On September 8, 2026, Altera announced that it was shipping Agilex 3 and Agilex 5 field-programmable gate arrays (FPGAs), chips that can be reconfigured after manufacture, with “PQC-enabled secure boot.” It named neither the algorithm nor its parameter set, as Quantum Observer reported. Altera may well use a standardized algorithm, but from its announcement alone a buyer cannot tell which one.
Eight days later, Lattice Semiconductor described its new Mach-N2 FPGAs as offering “CNSA 2.0-compliant PQC,” with “ML-DSA, LMS, and XMSS for authentication” and “ML-KEM for key exchange.” Buyers bound by CNSA 2.0, NSA’s algorithm suite for national security systems, need ML-KEM-1024 and ML-DSA-87, the parameter sets NSA names in version 2.2 of its FAQ. Lattice gave neither parameter sets nor a certificate number. Its compliance claim is self-declared, and a buyer can ask for the parameter sets and for the module and product validations that its own deployment requires.
The case for shorthand
The strongest objection to this guide is that standards bodies use the same vocabulary. In RFC 9794, the IETF wrote that post-quantum algorithms “can also be called ‘quantum-resistant’ or ‘quantum-safe’ algorithms.” The European Telecommunications Standards Institute runs a Working Group for Quantum-Safe Cryptography. A buyer who treated those words as warning signs would turn away vendors of standardized algorithms along with the standards bodies themselves.
In the same RFC, the IETF noted that some prefer “post-quantum,” because compromises “could make the terms quantum-resistant or quantum-safe misleading.” On vocabulary, the objection is still correct. In the cases above, the warning sign was a missing document, whether the name of the algorithm and its standard, the source of the key material, or a certificate number. A vendor that uses “quantum-safe” accurately can supply all three.
Five questions for a vendor
In November 2026, NSA and the Cybersecurity and Infrastructure Security Agency joined the Australian Signals Directorate’s Australian Cyber Security Centre in reissuing “Post-quantum questions to ask your vendors,” which the Australian agency first published in July. Bruce Schneier listed nine warning signs of cryptographic “snake oil” in his Crypto-Gram newsletter in February 1999, among them proprietary cryptography and unsubstantiated claims.
The five questions below are Quantum Observer’s own. A buyer can use them to test any pitch for the four patterns.
- Which algorithm and parameter set does the product use, and which standard specifies them? NIST specified its approved post-quantum schemes in FIPS 203, FIPS 204, FIPS 205, and Special Publication 800-208.
- What is the certificate number? Buyers can check CMVP and entropy-source certificates on NIST’s public search pages.
- Where does the key material come from, and how does the other party receive it?
- Which attacks does the product address, and which does it leave to other controls? NSA listed the limitations of QKD at the level of detail a buyer should expect.
- Who outside the company has published an analysis of the design?
A vendor with an accurate claim can answer most of them from documents it already has.
What would change this assessment
Buyers will meet more of these claims as federal deadlines approach. Starting in 2027, all new commercial national security systems must be able to support quantum-resistant algorithms, NSA said on October 1, 2026. Under Executive Order 14412, signed on June 22, 2026, federal agencies must move high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030.
For the products named here, the assessment would change with evidence a buyer can check: a published design, a key-distribution model, an independent audit, or a validation certificate that covers the claim.
Two federal certification programs are changing for post-quantum products. The National Information Assurance Partnership (NIAP) oversees the evaluation of commercial IT products for national security systems. In version 2.2 of its CNSA 2.0 FAQ, NSA wrote that “[i]n 2027, NIAP will no longer accept products for certification that have not started their quantum transition.” NIST said in its final transition plan that it is revising the CMVP’s processes, as the executive order directed.
