On 22 June 2026, Feitian Technologies announced the completion of a major post-quantum cryptography upgrade across its core authentication product portfolio. The announcement covered Smart Cards, PKI Tokens, and FIDO Security Keys — and it deserves more attention than a press release typically receives. This is not a marketing milestone. It is a hardware architecture change with direct implications for how organisations in financial services, government, healthcare, and critical infrastructure should be thinking about their authentication hardware procurement right now.

This article translates the announcement into operational terms for security leaders in the Nordics and Baltics who are evaluating hardware authentication or reviewing their identity security roadmap for the next three to five years.

What Feitian actually did

The headline is that Feitian has integrated a dedicated post-quantum cryptography co-processor at the chip level across its product lines. That distinction — chip level, not firmware or software — matters significantly, and we will return to it.

The upgrade adds native support for two algorithms that NIST finalised as international standards in August 2024:

• ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) — a key encapsulation mechanism for securing the exchange of cryptographic keys. Used for secure email, encrypted file exchange, enterprise messaging, and data synchronisation.
• ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) — a digital signature algorithm for authentication. Used for high-value transaction approvals, VPN access, government system authentication, and identity verification workflows.

These algorithms are specifically designed to remain secure against cryptanalytic attacks performed by quantum computers — the class of threats that renders current RSA and ECC-based systems vulnerable.

The Feitian FT-JCOS Smart Card Operating System, which underpins the upgraded product lines, now holds CC EAL6+ and EMVCo certifications at the chip level. EAL6+ is the highest Common Criteria Evaluation Assurance Level available for smart card hardware — a significant step up from the EAL5+ certification that characterised the previous generation.

The threat this addresses — and why it matters today, not in ten years

The implication is uncomfortable but important: the RSA or ECC-protected authentication events and data transmissions your organisation is generating today may be vulnerable to decryption within a decade. This is why NIST finalised the ML-KEM and ML-DSA standards in 2024 rather than waiting for quantum computers to materialise — the window for proactive migration is now, not later.

For Nordic organisations specifically, ENISA (the European Union Agency for Cybersecurity) published its post-quantum cryptography guidelines in 2022 and has since updated its recommendations to encourage early adoption planning. The Swedish NCSC and the Norwegian NSM have issued parallel guidance. The regulatory direction is unambiguous: begin PQC migration planning now, at the hardware layer first.

Why chip-level implementation is the only approach that matters

The Feitian announcement specifies that PQC algorithms are executed within an isolated hardware co-processor. This architectural choice is not a technical footnote — it is the core security property that differentiates meaningful PQC protection from marketing-grade PQC claims.

Software and firmware-based PQC implementations run on the main processor. That means key material is handled in a compute environment that can be compromised by side-channel attacks, by operating system vulnerabilities, or by an attacker who has already achieved code execution on the device. The PQC algorithm may be mathematically sound; the implementation environment may not be.

A hardware co-processor executing PQC algorithms in isolation provides full key isolation. The private key never leaves the dedicated hardware context. Side-channel attack surface is dramatically reduced. The security property is structural rather than dependent on the integrity of the surrounding software environment.

"By executing post-quantum algorithms within an isolated hardware co-processor, FEITIAN ensures full key isolation and significantly reduces exposure to side-channel attacks, offering stronger protection than software- and firmware-based PQC approaches." — Feitian Technologies press release, 22 June 2026

This matters for procurement because it means you are evaluating not just whether a device claims PQC support, but where the PQC computation occurs and how the key material is protected during that computation.

The certification landscape — updated

Vol. 4 of our Zero Assumptions series covers the full hardware certification hierarchy in detail. The Feitian PQC upgrade changes the comparison meaningfully. Here is the updated picture:

What the upgrade delivers operationally — by use case

FIDO Security Keys

For organisations deploying FIDO2 hardware keys for passwordless authentication — workstation login, VPN access, cloud SSO — the PQC upgrade adds a quantum-resistant layer to the existing origin-binding architecture that already defeats adversary-in-the-middle phishing attacks. The FIDO2 phishing resistance is unchanged; the upgrade adds protection against a future adversary using quantum capabilities to attack the underlying cryptographic primitives of the authentication exchange itself.

PKI Tokens and Smart Cards

For organisations using PKI-based authentication — digital signatures on contracts, e-government workflows, secure VPN authentication, certificate-based access to classified systems — ML-DSA-based signatures provide a drop-in replacement pathway for RSA/ECC certificate systems. Existing infrastructure is not replaced; the Crypto-Agile architecture allows legacy and PQC-enabled systems to run in parallel, with new authentication events gaining quantum-resistant protection while existing PKI infrastructure continues operating.

Secure email and classified data exchange

ML-KEM-based key encapsulation addresses the HNDL threat directly for data in transit. Organisations handling sensitive correspondence — legal, financial, medical, governmental — can begin protecting new transmissions against future quantum decryption immediately, without waiting for a full infrastructure migration.

What this means for the NeoWave vs Feitian hardware decision

Ciptor distributes both NeoWave and Feitian hardware, and we recommend them for different deployment contexts. That recommendation needs updating in light of this announcement.

NeoWave remains the recommendation for organisations where supply chain sovereignty is the primary requirement — specifically those in defence supply chains, handling classified EU data, or subject to regulatory requirements that mandate French or EU-origin hardware. NeoWave's ANSSI Security Visa provides the strongest available sovereign certification and full French-jurisdiction supply chain transparency. The PQC question for NeoWave is still being evaluated by ANSSI; no PQC co-processor announcement has been made at the time of writing.

Feitian has moved meaningfully in the certification landscape with this upgrade. The CC EAL6+ chip certification and hardware-native PQC co-processor make Feitian the most forward-compatible enterprise authentication hardware available at scale today, for organisations whose primary requirements are cryptographic assurance depth and long-term quantum readiness rather than EU-origin supply chain.

For most large-enterprise deployments, the practical approach remains a tiered model: NeoWave for privileged users and classified data environments, Feitian for the broader workforce — now with the added assurance that the Feitian fleet is quantum-ready at the hardware layer.

What to do now