PQC concepts
What is Cross-verification?
Running the same cryptographic operation through two independent implementations and comparing results - defends against implementation bugs (not algorithm weakness). QNSI cross-verifies between liboqs (C/native) and @noble/post-quantum (pure-JS) on Maximum and Government tiers across the 18 algorithms shared by both providers.
Decision context
Why Cross-verification matters
Cross-verification can detect some implementation defects by comparing independent implementations, but identical output does not prove algorithm security and two wrappers around the same underlying library are not independent. Randomized signatures and implementation-specific encodings also require carefully designed comparisons.
How to evaluate Cross-verification
Document implementation provenance and independence, the operations compared, normalization rules and disagreement policy. Use authoritative vectors where deterministic comparison is possible and verify each signature independently where it is not. Force a provider disagreement to prove that the production path fails closed.
PQC concepts
PQC concepts evidence boundary
Post-quantum programmes combine cryptography, architecture, data lifetime, operational ownership, and migration governance. A concept is useful only when it changes a concrete inventory, policy, design, test, or evidence decision. Treat terminology as a decision aid rather than proof that a control exists.
FAQ
Common questions
What is Cross-verification?
Running the same cryptographic operation through two independent implementations and comparing results - defends against implementation bugs (not algorithm weakness). QNSI cross-verifies between liboqs (C/native) and @noble/post-quantum (pure-JS) on Maximum and Government tiers across the 18 algorithms shared by both providers.
Why does Cross-verification matter?
Cross-verification can detect some implementation defects by comparing independent implementations, but identical output does not prove algorithm security and two wrappers around the same underlying library are not independent. Randomized signatures and implementation-specific encodings also require carefully designed comparisons.
How should Cross-verification be evaluated?
Document implementation provenance and independence, the operations compared, normalization rules and disagreement policy. Use authoritative vectors where deterministic comparison is possible and verify each signature independently where it is not. Force a provider disagreement to prove that the production path fails closed.
More