FIPS 140-2 hits historical status as Thales, Entrust and OpenID push post-quantum cryptography forward

FIPS 140-2 enters historical status three days after publication

The deadline that has governed federal cryptographic procurement for two decades formally retires on September 21, 2026, when every FIPS 140-2 validation moves to historical status. After that point, modules that have not completed the transition to FIPS 140-3 are no longer the standard basis for new federal acquisitions, and commercial customers who mirror federal procurement language face the same cut-over. The change is administrative rather than a vulnerability disclosure, but it forces a re-papering exercise for any organization that still cites 140-2 validation certificates in policies, vendor questionnaires or procurement terms.

Hardware HSMs ship for the FIPS 140-3 and Common Criteria era

The same week that 140-2 expires, one hardware vendor has launched a flagship HSM explicitly positioned for AI and quantum-era workloads. Thales' Luna 8 is undergoing independent assessment against FIPS 140-3 Level 3 and EU Common Criteria, the two certifications that practitioners now have to point to in lieu of 140-2. Marketing framing aside, the practical signal is that the next generation of on-premises key custody is being built around the newer standard, which means procurement teams can plan module refreshes against FIPS 140-3 Level 3 from here on.

The launch is also a reminder that classic symmetric primitives inside those modules are now expected to interoperate with post-quantum key exchange and signature schemes added higher in the stack.

CBOM and crypto-agility become procurement-grade artefacts

One platform vendor has extended its cryptographic security offering with Cryptographic Bill of Materials capabilities aimed squarely at two pressure points: post-quantum risk management and the European Union's Digital Operational Resilience Act, commonly referenced as DORA for financial-sector operational resilience. CBOMs give security and audit teams a structured way to enumerate every algorithm, key length, certificate and library in use, which is the prerequisite for the kind of crypto-agility posture that regulators now expect.

For institutions that have to answer to both post-quantum roadmaps and DORA controls, a machine-readable inventory of cryptographic assets is moving from nice-to-have to required evidence.

Identity protocols get a post-quantum track

The OpenID Connect community has begun publishing guidance for vendors and relying parties on integrating post-quantum cryptography into the identity layer that secures single sign-on across the public internet. The work rides on the three sets of post-quantum cryptography standards that NIST finalized on August 13, 2024, which have since become the baseline for federal migration planning. Identity is the layer where a failed migration is most visible: a token-signed-by-the-wrong-algorithm error at a bank or government login is the user-facing face of a cryptographic transition, which is why protocol-level guidance now has to be issued alongside library and hardware work.

Policy scaffolding for PQC migration

National policy has moved beyond general direction. Executive Order 14412 and the wider global post-quantum readiness agenda are now being operationalized through procurement language and standards alignment, with NIST's August 13, 2024 standard set as the technical anchor that CBOMs, identity flows and hardware modules all have to satisfy. Practitioners reading this together should see a consistent message: a deadline, an inventory format, a protocol path and a hardware generation, each designed to slot into the others.

What practitioners should check after September 21, 2026

The immediate action item is to audit every reference to FIPS 140-2 in vendor documentation, compliance questionnaires and internal controls before September 21, 2026, and replace it with the equivalent FIPS 140-3 reference where the underlying module has been re-validated. From there, the follow-ups are: confirm that CBOM exports cover algorithm, key length and certificate fields for every system in scope of DORA; track OpenID Connect post-quantum guidance for any customer-facing or workforce SSO deployment; and line up FIPS 140-3 Level 3 hardware refreshes against the HSM generation now entering assessment.

Practitioners who need to verify digests, hashes or encoded payloads while these migrations are running can use the SHA256 Hash Generator or the Sha512 Hash Generator for one-off checks, apply a repeating key with the XOR Encryption Online tool when validating obfuscation schemes, and look at the Binary to Text Alternative for Full Unicode and Privacy guide where Unicode handling is part of the migration scope.