---
title: "Prepare for post-quantum and FIPS"
description: "List every algorithm the app uses in a CBOM, sign with ML-DSA, exchange keys with a hybrid, and turn on FIPS mode with a named module."
section: "guides"
status: "Planned for 1.6"
spec: "post-quantum"
canonical: "https://mainsdk.dev/docs/guides/prepare-for-post-quantum-and-fips"
updated: "2026-10-28"
---

# Prepare for post-quantum and FIPS

> List every algorithm the app uses in a CBOM, sign with ML-DSA, exchange keys with a hybrid, and turn on FIPS mode with a named module.

Status: Planned for 1.6 · Canonical: https://mainsdk.dev/docs/guides/prepare-for-post-quantum-and-fips · Updated: 2026-10-28

You will inventory your cryptography and move one signature to a post-quantum algorithm. It takes about 30 minutes.

## You need

- Node 24 or newer for ML-DSA and ML-KEM. Run `pqAvailable("ML-DSA-65")` to ask a platform; one without it fails with `MAIN-CRYPTO-0010` and nothing is substituted.

## 1. Inventory what the app uses

Run `mainsdk cbom`. It scans your source for algorithm names and writes a CycloneDX 1.6 CBOM. `quantumVulnerable` lists the components that a quantum computer would break, such as RSA and ECDSA.

## 2. Sign with ML-DSA and exchange keys with a hybrid

`pqGenerateKeyPair`, `pqSign` and `pqVerify` use ML-DSA. `hybridGenerate`, `hybridEncapsulate` and `hybridDecapsulate` join X25519 and ML-KEM-768 so an attacker has to break both. Pass an `AlgorithmInventory` to have each use recorded.

## 3. Turn on FIPS mode

```yaml title="main.yaml"
crypto:
  fips: true
  module: { name: Acme Crypto Module, version: "3.0.9", certificate: "<CMVP certificate number, 3 to 5 digits>" }
```

`mainsdk check` fails with `MAIN-CRYPTO-0013` when `module` is missing or its certificate is not a number of 3 to 5 digits. In FIPS mode, a call for an unapproved algorithm fails with `MAIN-CRYPTO-0011`, and a platform without a validated provider fails with `MAIN-CRYPTO-0012`. MainSDK never writes a certificate number for you; it comes from your module's validation.

## Check that it works

- `mainsdk cbom --json` lists your algorithms and marks the vulnerable ones.
- Verify a signature after changing one byte: it returns false.