Post-quantum cryptography audit checklist (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, LMS/XMSS)
================================================================================

What a post-quantum cryptography audit must cover: specification conformance to FIPS 203/204/205, input validation, constant-time behavior, hedged signing, hybrid combiners, stateful-signature state management, and crypto-agility.

Specification conformance: Implements the final FIPS 203/204/205 (2024-08-13) or SP 800-208, not a pre-standard round submission | Passes the NIST ACVP / CAVP known-answer tests for every parameter set shipped | Domain-separation bytes, context strings, and pre-hash variants match the standard exactly
Input validation: ML-KEM: modulus check on encapsulation keys, hash check on decapsulation keys, length checks on ciphertexts | ML-DSA / SLH-DSA: bounds checks on all decoded signature components; reject malformed encodings before any secret operation | Stateful signatures: verifier validates parameter identifiers and index ranges
Side channels: No secret-dependent branches, memory accesses, or variable-time arithmetic (division, modular reduction, floating point) | Rejection-sampling loops do not leak secret-correlated information | Verified with tooling (for example ctgrind, dudect, or formal methods), not by inspection alone
Randomness and hedging: Fresh seeds from an approved DRBG for every key generation and encapsulation | ML-DSA and SLH-DSA use hedged signing unless there is a documented reason for deterministic mode | Fault-attack countermeasures where deterministic signing or hash-based signing is used
Protocol integration: Hybrid combiners bind both shared secrets and both ciphertexts (RFC 10024, SP 800-227) | Key-share encoding order matches the named group definition | Downgrade and negotiation paths cannot silently drop the post-quantum component | Stateful signature state is persisted atomically, never cloned, and survives crash and restore
Crypto-agility and operations: Algorithm identifiers are negotiated or versioned so a future switch (for example to HQC or FN-DSA) does not require a protocol redesign | Key and signature sizes are accounted for in storage, MTU, and DoS budgets | Documented migration plan aligned to the NIST IR 8547, CNSA 2.0, EU, or UK NCSC timeline that applies

Source page: https://pqaudit.org/audit-checklist/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12