Global – October 31, 2026 -- CIQ is preparing the ML-KEM and ML-DSA post-quantum algorithm implementations in Network Security Services (NSS) for FIPS 140-3 validation. Distinguished Engineer Jeremy Allison, a Samba co-creator, leads the effort, which also covers Common Criteria evaluation for Rocky Linux from CIQ Pro (RLC Pro) and other CIQ products.

Transpiled Rust code forces repeated manual remediation at CIQ

Part of the NSS implementation was written in Rust and transpiled into C. The generated code worked but was not ready for FIPS validation. Its functions copied intermediate values onto the stack, and those values had to be securely erased before the functions returned.

CIQ fixed this with AI-assisted hand-edits and careful review across the generated code. Each package update regenerates the Rust-to-C code, so the work has to be repeated. Allison describes FIPS compliance as requiring "an insane amount of detailed programming and test work."

Labs demand changes to near-compliant cryptography packages

Allison says the cryptography packages shipped on Rocky are close to FIPS compliance, but lab review turns up many small required changes. These include entropy source selection, secure zeroization of intermediate values, test conformance and key generation testing. The tests and expected outputs are already defined. The difficulty is passing them across increasingly complex configurations while guarding against incomplete zeroization, leaked key material and timing attacks.

Google and Anthropic research in 2026 raised Allison's urgency on migration

Allison was initially skeptical that quantum computing would become a practical threat. He was more concerned about the complexity of protocols such as TLS and Kerberos, which makes correct implementations extremely difficult, and he still sees that as the more immediate danger for many organizations.

Two 2026 developments changed his view of longer-term risk. In March, Google Quantum AI researchers published estimates that breaking the elliptic curve cryptography used by cryptocurrencies and other systems could require about 20x fewer quantum resources than previously estimated. Google used a zero-knowledge proof so others could verify the result without receiving a roadmap for the attack.

In July, Anthropic reported that its Claude Mythos Preview model helped researchers find improved attacks against HAWK, a candidate in NIST's post-quantum signature competition, and against a reduced-round version of AES. The HAWK team withdrew the candidate the next day. The findings do not compromise production systems.

Allison draws a conclusion about agility: organizations need systems and processes that let them replace both post-quantum and conventional algorithms as threats and standards change in an AI-assisted world.

CIQ publishes FIPS patches in open source repositories

CIQ releases its FIPS compliance changes as separate patches with detailed explanations of what changed and why. They are available through the CIQ Rocky Linux FIPS repositories, where other developers can inspect and contribute to them. Allison says the code changes needed for FIPS only make sense as open source, applied and contributed back to the upstream projects used to achieve certification.