QNSI platform
What is Crypto-policy tier?
Per-tenant enforcement level that locks which PQC algorithms and parameter sets are allowed. Four tiers: default (all 87 algorithms), strict (FIPS-finalised KEMs + signatures), maximum (strongest parameter sets, cross-verification mandatory), government (CNSA 2.0 lock + HSM required). Defined in packages/security/src/crypto-policy.ts.
Decision context
Why Crypto-policy tier matters
A cryptographic policy tier should translate assurance requirements into enforced algorithms, parameter sets, providers, custody, rotation and compatibility rules. If it only changes labels or UI, it cannot prevent downgrade, unapproved primitives or inconsistent application choices.
How to evaluate Crypto-policy tier
Attempt disallowed operations and verify rejection at the executing boundary. Change policy and observe versioned rollout, consumer reconciliation, audit evidence and rollback. Confirm that hybrid compatibility is explicitly selected and separately recorded rather than becoming an automatic fallback when a PQC operation fails.
QNSI platform
QNSI platform evidence boundary
QNSI platform terms describe intended control or evidence boundaries. Their presence in documentation is not proof that a customer deployment executed them. Verify the selected service path, tenant policy, custody provider, production record, and independent evidence before relying on the term in an assurance decision.
FAQ
Common questions
What is Crypto-policy tier?
Per-tenant enforcement level that locks which PQC algorithms and parameter sets are allowed. Four tiers: default (all 87 algorithms), strict (FIPS-finalised KEMs + signatures), maximum (strongest parameter sets, cross-verification mandatory), government (CNSA 2.0 lock + HSM required). Defined in packages/security/src/crypto-policy.ts.
Why does Crypto-policy tier matter?
A cryptographic policy tier should translate assurance requirements into enforced algorithms, parameter sets, providers, custody, rotation and compatibility rules. If it only changes labels or UI, it cannot prevent downgrade, unapproved primitives or inconsistent application choices.
How should Crypto-policy tier be evaluated?
Attempt disallowed operations and verify rejection at the executing boundary. Change policy and observe versioned rollout, consumer reconciliation, audit evidence and rollback. Confirm that hybrid compatibility is explicitly selected and separately recorded rather than becoming an automatic fallback when a PQC operation fails.
More