Quantum XChange’s PhioTX-V gains EU cybersecurity certification
The evaluation includes post-quantum key exchange, but covers one software version and configuration. Certificate validity and security support have different end dates.
Reading tools for text size, copying, printing and your reading list
Quantum XChange’s PhioTX-V key-management software has received a European cybersecurity certificate. The evaluation covers post-quantum key exchange, giving security buyers a defined product assessment to examine rather than only a vendor’s promise.[1][2]
The company announced the milestone on November 12. The European Union Agency for Cybersecurity’s register records a November 10 certificate for version 4.5.6. It carries “Substantial” assurance under EUCC, the EU’s cybersecurity certification scheme based on Common Criteria, and evaluation level EAL2.[1][3]
The certified scope includes ML-KEM-1024, a standardized method for establishing encryption keys designed to resist attacks using quantum computers. PhioTX-V manages and exchanges symmetric encryption keys between key-management entities. ML-KEM protects key establishment between those entities; this post-quantum cryptography runs on conventional computers.[2]
The distinction matters because certification identifies both the product and the conditions assessed. DEKRA’s evaluation applies to the named software image deployed in a KVM virtual machine, which runs software in an isolated computing environment, and configured according to the evaluated guidance. The configuration requires EUCC mode, which the certification report says is disabled by default.[4]
DEKRA reports checking development and delivery evidence, repeating a sample of developer tests, independently testing selected interfaces and examining vulnerabilities against the scheme’s Basic attack-potential criteria. This is an evaluation of specified security functions, not a new mathematical proof that ML-KEM can never be broken.[4]
Nor does the certificate cover every surrounding network or every installation. The evaluated configuration assumes physical protection, trustworthy administrators, protected credentials and regular updates. Buyers still need to establish that their own deployment matches those conditions.[4]
A second practical distinction is certificate validity versus promised support. The ENISA record lists expiry on November 9, 2031. Quantum XChange’s current cybersecurity information promises security updates and patches for version 4.5.6 through March 16, 2029. The certificate’s listed expiry is not a promise of updates through 2031; buyers planning a longer deployment should confirm what support will be available after March 2029.[1][5]
The milestone advances beyond the company’s February announcement of an EUCC compliance mode, which described progress toward certification. For organizations replacing cryptography vulnerable to future quantum attacks, the useful next question is whether the evaluated version, configuration and maintenance terms fit the system they intend to operate.[6]