Abstract
The NSA's CNSA 2.0 mandates post-quantum cryptographic transitions across all NSS and DIB contractors by 2030, with priority systems required by 2026. NIST finalized FIPS 203, 204, and 205 in August 2024. Yet as of June 2026, DISA has published no STIG specifically addressing post-quantum cryptographic controls.
This paper introduces PQC-01-STIG-V1R1, a comprehensive DoD-style Post-Quantum Cryptography STIG, developed by NouchiX to fill this critical compliance gap. We document 12 actionable controls mapped to existing CCI identifiers, NIST 800-53 Rev 5 controls, and CNSA 2.0 requirements. We further describe the production implementation of these controls in the KHEPRA MCP Server, including ML-DSA-65 / FIPS 204 attestation on every cryptographic operation, offline compliance validation, and Iron Bank-ready containerization.
1. The Policy Gap
1.1 Mandates Without Checklists
NSM-10 (May 2022) directed all federal agencies to inventory cryptographic systems vulnerable to quantum attack and begin migration planning. OMB M-23-02 followed with reporting requirements. The CNSA 2.0 advisory (September 2022) set hard timelines. NIST's work is complete — FIPS 203, 204, and 205 were finalized August 13, 2024. The algorithm question is settled.
The compliance framework question is not. DISA STIGs exist for hundreds of technologies — RHEL, Windows, Kubernetes, PostgreSQL, Apache — but no STIG addresses how to implement, validate, or audit post-quantum cryptographic controls. Program managers, ISSOs, and DIB contractors have mandatory algorithm requirements but no authoritative checklist to assess conformance.
1.2 The Harvest-Now-Decrypt-Later Threat Is Active Today
Adversaries capable of quantum decryption — including nation-state actors assessed to be 8–15 years from cryptographically relevant quantum computers — are actively collecting encrypted data today for future decryption. Intelligence community assessments classify this as a current, active collection threat against NSS communications, CUI, and controlled technical data.
Data encrypted today with RSA-2048 or ECDSA P-256 may be decrypted within the decade. DIB contractors transmitting ITAR-controlled technical data or sharing CUI with acquisition programs are generating this attack surface daily.
CNSA 2.0 Transition Timeline
2. PQC-01-STIG-V1R1: The Twelve Controls
CCI-mapped · NIST 800-53 Rev 5 cross-referenced · CNSA 2.0 aligned
CNSA 2.0 Algorithm Approval
RSA, ECDSA, ECDH, and DH are non-compliant for new NSS implementations as of 2025. ML-KEM-1024 (FIPS 203), ML-DSA-87 (FIPS 204), AES-256 and SHA-384/512 only; LMS/XMSS for software and firmware signing.
ML-DSA Key Strength
National security systems must use ML-DSA-87 (CNSA 2.0; 2,592-byte public keys). ML-DSA-65 (1,952-byte public keys) meets FIPS 204 but not CNSA 2.0. ML-DSA-44 is not approved for NSS use.
ML-KEM Encapsulation Strength
National security systems must use ML-KEM-1024 (CNSA 2.0; 1,568-byte encapsulation keys). ML-KEM-768 meets FIPS 203 but not CNSA 2.0. ML-KEM-512 is not approved for NSS key encapsulation.
Hybrid Cryptography During Transition
Systems in active transition (2025–2030) may use hybrid key exchange that combines a classical algorithm with ML-KEM, for example X25519MLKEM768 in TLS 1.3. NSA permits hybrid during the transition but does not require it; the CNSA 2.0 end state is ML-KEM-1024.
Key Storage and Protection
ML-DSA and ML-KEM private keys for identity/signing must be in FIPS 140-3 Level 3+ validated HSMs for systems above SECRET or handling CUI requiring NSS protection.
Constant-Time Implementation
PQC library must have documented constant-time guarantees for all operations involving private key material. Acceptable: liboqs, Cloudflare CIRCL, pq-crystals reference.
Certificate Chain Validation
System must validate X.509 certificates with id-ml-dsa-65 OID in subjectPublicKeyInfo and signatureAlgorithm fields without error.
Algorithm Inventory & Cryptographic Agility
A complete CBOM must exist identifying every public-key algorithm use, library version, key size, and migration status. NSM-10 reporting requires it.
FIPS 140-3 Module Validation
The PQC cryptographic module must have an active CMVP certificate number. "Review pending" or "implementation under test" status is non-compliant for production NSS use.
Key Lifecycle and Rotation
ML-DSA signing keys must rotate at ≤12 months for long-term identity keys. ML-KEM session keys must be ephemeral (per-session). Static long-lived KEM keys = CAT II finding.
PQC Random Number Generation
All PQC key generation must use NIST SP 800-90A Rev 1 compliant DRBG (CTR_DRBG/AES-256 or Hash_DRBG/SHA-512) seeded from a hardware entropy source.
Attestation and Audit Trail
Tamper-evident audit trail required for all PQC key generation, signing, and encapsulation events. Audit entries must themselves be signed with ML-DSA. KHEPRA implements this via the AdinKhepra DAG attestation chain.
3. Production Implementation: KHEPRA MCP Server
| File | Rows | Content |
|---|---|---|
| CCI_STIG_NIST_CMMC_Complete.csv | 19,943 | DISA STIG findings mapped end-to-end to CMMC practices |
| Canonical Baseline | 19,943 | Embedded in binary via embed.FS |
Quick Start — Free, No License Required
The Community tier pqc_stig tool is permanently free. Add to Claude Desktop or any MCP-capable AI assistant:
{
"mcpServers": {
"khepra": {
"command": "docker",
"args": [
"run", "--rm", "-i",
"-e", "KHEPRA_MODE=sovereign",
"-v", "/var/lib/khepra:/var/lib/khepra",
"ghcr.io/nouchix/pqc-khepra-mcp:latest"
]
}
}
}Then prompt your AI assistant: "Run pqc_stig on my project and tell me if I'm CNSA 2.0 compliant."
View on MCP Registry — io.github.nouchix/pqc-khepra-mcpReferences
- [1]NSA, "Commercial National Security Algorithm Suite 2.0," CNSSP 15, September 2022
- [2]NIST, "Module-Lattice-Based Key-Encapsulation Mechanism Standard," FIPS 203, August 2024
- [3]NIST, "Module-Lattice-Based Digital Signature Standard," FIPS 204, August 2024
- [4]NIST, "Stateless Hash-Based Digital Signature Standard," FIPS 205, August 2024
- [5]NSC, "National Security Memorandum on Promoting United States Leadership in Quantum Computing," NSM-10, May 2022
- [6]OMB, "Migrating to Post-Quantum Cryptography," M-23-02, December 2022
- [7]NIST, "Protecting Controlled Unclassified Information in Nonfederal Systems," SP 800-171 Rev 3, May 2024
- [8]NIST, "Security and Privacy Controls for Information Systems and Organizations," SP 800-53 Rev 5
- [9]DISA, "Red Hat Enterprise Linux 9 Security Technical Implementation Guide," V2R5
- [10]NIST IR 8547, "Transition to Post-Quantum Cryptography Standards," 2024
PQC-01-STIG-V1R1 is a community contribution. NouchiX makes no claim to official DISA endorsement. All control mappings reference publicly available CCI and NIST 800-53 Rev 5 data.
Run These Checks Against Your Infrastructure
ASAF implements all 12 PQC-01-STIG-V1R1 controls in a sovereign, air-gappable compliance platform. Get your SPRS score and Godfather Report today.
Get My CMMC Baseline