What Your Vendors Owe You under the Cyber Resilience Act

The Cyber Resilience Act (Regulation (EU) 2024/2847) changes how software is bought in Europe. It reaches far beyond connected devices. Every product with digital elements placed on the European market is covered, including software and libraries sold to businesses.

For a buyer, that is good news, because the regulation gives a precise list of what a vendor must provide. Here is the part that concerns cryptography, and how to use it.

The timeline

• 10 December 2024. The regulation enters into force.
• 11 September 2026. Vendors must report actively exploited vulnerabilities and severe incidents through a single platform run by ENISA, with an early warning within 24 hours, a notification within 72 hours and a final report no later than 14 days after a fix is available.
• 11 December 2027. Full application, essential requirements included.

What the regulation asks, on the cryptography side

• Protect the confidentiality of stored or transmitted data, in particular by encrypting it at rest and in transit with state-of-the-art mechanisms.
• Protect the integrity of data, commands and programs against unauthorized changes.
• List the product's components in a machine-readable software bill of materials (SBOM), in CycloneDX or SPDX for example.
• Handle vulnerabilities throughout the support period, and distribute security fixes without delay and free of charge.
• Declare a support period of at least five years, unless the product's expected use is shorter.

The state of the art is moving

The regulation names no algorithm, it asks for state-of-the-art mechanisms. And that state of the art is changing. NIST standardized post-quantum algorithms in 2024, the European roadmap plans to migrate high-risk uses by the end of 2030, and ANSSI, the French national cybersecurity agency, considers it will not be reasonable to buy products without post-quantum cryptography after 2030.

A product bought today will still be in service at those dates. Its post-quantum roadmap is therefore part of its evaluation, just like its bill of materials or its patch policy.

A product bought today will still run in 2030, and its cryptographic roadmap is part of the purchase.

The questions to ask every supplier

• Algorithms. Which ones does the product use to encrypt and sign, and can it change them without breaking what was already encrypted?
• Post-quantum. What is its roadmap, and with which hybridization?
• Bill of materials. Where is the SBOM of each version, and in which format?
• Vulnerabilities. How are they reported, and how fast are they fixed?
• Support. How long does it last, and are security fixes free?
• Authenticity. How do you check that a version really comes from the vendor before installing it?

Feranor PQC Suite's answers

• Algorithms. Hybrid by default, ML-KEM-1024 with ECDH P-384 for key exchange, SLH-DSA co-signed with ECDSA P-384 for signatures, under the ANSSI profile; parameters change per profile, and messages stay readable from one version to the next.
• Bill of materials. A CycloneDX SBOM for each component and each container image, delivered with every version.
• Vulnerabilities. A published point of contact (/.well-known/security.txt), and free security fixes for every user of a maintained version.
• Support. Five years of maintenance per major version.
• Authenticity. The checksums of each version are signed with Feranor's release certificate (SLH-DSA-SHA2-256s), whose fingerprint is published.
• French framework. The suite is declared to ANSSI as a means of cryptology (declaration no. 34734727).