Comparison
QNSP vs Azure Key Vault
An honest, code-grounded side-by-side. The critical fact to start with: Azure Key Vault's own data-plane key-types page (learn.microsoft.com, last updated 2026-04-09) lists EC, RSA, and AES only — no PQC algorithms. Microsoft's SymCrypt library has ML-KEM and ML-DSA, but that's the library + Windows OS, NOT Azure Key Vault. Microsoft has a real PQC roadmap (2029 default-on, 2033 full transition); for buyers under CNSA 2.0 or APAC FSI procurement timelines that don't align with 2029, QNSP is the in-market alternative today.
Azure Key Vault is a mature, FIPS-validated, well-integrated KMS for Microsoft-shop customers. For an organisation whose stack is Azure + AD + M365 + Windows Server, Key Vault is the path of least resistance — and Microsoft's 2029 default-on roadmap is real. The honest question is whether your regulator's PQC timeline aligns with Microsoft's. If you need PQC operating live today across multi-cloud, sovereign, or APAC-regulated workloads, QNSP is the in-market alternative.
Side by side
Eleven categories that matter to a Microsoft-shop buyer evaluating PQC
| Category | QNSP | Azure Key Vault |
|---|---|---|
| PQC algorithms in the KMS data plane | 90 algorithms across 14 PQC families (27 KEMs + 63 signatures) in the active KMS data plane today. Tenants on Maximum and Government policy tiers operate ML-KEM-1024, ML-DSA-87, SLH-DSA, and HQC for production wrap/unwrap and sign/verify. Independently reproducible from github.com/cuilabs/qnsp-public. | Zero NIST-finalized PQC algorithms in the Azure Key Vault data plane as of April 2026. The official 'Key types, algorithms, and operations' page (ms.date 2026-04-09) lists only EC (P-256, P-256K, P-384, P-521), RSA (2K/3K/4K with OAEP/PSS/PKCS1.5), and AES (KW/GCM/CBC). No ML-KEM, ML-DSA, FN-DSA, SLH-DSA, Falcon, HQC, or any PQC family. Source: learn.microsoft.com/azure/key-vault/keys/about-keys-details. |
| SymCrypt PQC vs Key Vault PQC | The QNSP KMS service uses liboqs (native C) + noble (pure JS) directly. PQC primitives are operated by the service that issues the keys — no separate library-OS-KMS distinction the buyer has to reason about. | Microsoft's SymCrypt library shipped ML-KEM + ML-DSA in the Nov 2025 Windows update, GA in Windows 11 / Windows Server 2025 via CNG APIs. That is library + OS, NOT Azure Key Vault. Microsoft's own Aug 2025 security blog does not list Azure Key Vault among PQC-GA surfaces. Sources: microsoft.com/security/blog/2025/08/20. |
| Microsoft's published PQC roadmap | QNSP ships PQC by default on every tier today. The 'when do we get PQC' question has the answer 'now' for new customers. | Microsoft has publicly committed to 2029 as the 'early adoption / quantum-safe capabilities default-on' target and 2033 as the 'full transition completion' target (two years ahead of the U.S. 2035 deadline). Honest framing: this is a real roadmap from a serious vendor; the timeline gap between Microsoft's roadmap and a regulator-driven CNSA 2.0 procurement requirement is the procurement question. |
| HSM model + FIPS validation | Root key custody at FIPS 140-3 Level 3 via integrated HSM partners — BYOH across 8 vendors via PKCS#11 (AWS CloudHSM, Azure Managed HSM/Marvell LiquidSecurity, Thales Luna, Entrust nShield, Utimaco CryptoServer, Marvell LiquidHSM, Fortanix DSM, HashiCorp Vault HSM). Optional M-of-N Shamir key escrow. The QNSP service plane is not itself CMVP-validated; module-level submission is planned, currently delivered via partner HSM certification at the custody layer. | Managed HSM + Key Vault Premium use Marvell LiquidSecurity adapters and are FIPS 140-3 Level 3 validated. Standard tier = FIPS 140-2 Level 1 (software). hsmPlatform attribute: 2 = FIPS 140-3 L3, 1 = FIPS 140-2 L2, 0 = software. Sources: learn.microsoft.com/azure/key-vault/managed-hsm/overview + about-keys-details. |
| Multi-cloud / portability | 11 cloud-vendor connectors out from QNSP. Same wire contract on AWS, GCP, Azure, on-prem, air-gapped, and sovereign deployments. SDKs identical across clouds. | Azure-only. No discovery of non-Azure keys, no cross-cloud key inventory. Migrating keys to AWS KMS / GCP KMS requires BYOK export/import per-key. Source: learn.microsoft.com/azure/key-vault/managed-hsm/overview. |
| Crypto-policy tier enforcement | Four hard-enforced tiers (default / strict / maximum / government) with per-tier algorithm allow-lists enforced at the edge gateway, KMS, and vault. A tenant cannot accidentally downgrade. | Per-tenant crypto-policy tier abstraction is not a built-in Key Vault capability. Customers compose policy via Azure Policy + per-key key_ops flags + per-vault RBAC. No equivalent default/strict/maximum/government enforcement model in the product. Source: learn.microsoft.com/azure/key-vault/keys/about-keys-details. |
| Audit trail | 59 crypto-critical event types across 12 source services flow into a hash-chained Merkle ledger. ML-DSA-65-signed events, SHA3-256/512 checkpoints, receipt-replay verification, real-time WebSocket streaming for SIEM. | Audit via Azure Monitor / Log Analytics. Tamper-evidence depends on log file integrity validation customers configure separately. PQC-signed audit events not advertised on the Managed HSM overview. Source: learn.microsoft.com/azure/key-vault/managed-hsm/overview. |
| Free tier + transparent pricing | Free forever: 20 KMS keys + 20,000 KMS ops/month + 25 vault secrets + 10 GB PQC-encrypted storage + 50,000 API calls/month, no credit card. Published ladder up to $5,999 business-elite plus enterprise. | No published Key Vault free tier; pay-as-you-go from first call. Standard/Premium operations: $0.03 per 10,000 transactions; cert renewals: $3/renewal; HSM-protected keys: $5/key/month for first 250. Managed HSM hourly per cluster (~$4.80/hr Standard B1 per third-party blogs — verify against azure.microsoft.com/pricing/details/key-vault). The HSM-key-month + ops-per-call structure can be hard to forecast at scale. |
| Compliance frameworks (product-specific) | Seven frameworks mapped at the control level: SOC 2, ISO 27001, HIPAA, PCI DSS v4.0.1, GDPR, PDPA (Singapore), MAS TRM. Real-time evaluation from live service-health probes. | Azure Key Vault is in scope under Microsoft Trust Center for HIPAA, PCI DSS, SOC 1/2/3, ISO 27001, FedRAMP. PDPA (Singapore) and MAS TRM are not explicitly enumerated on the Key Vault product pages — Azure as a platform claims regional coverage via Trust Center, but Key Vault's product-page enumeration omits these APAC frameworks. |
| Microsoft ecosystem integration (genuine Azure strength) | Direct REST / SDK / CLI integration. Microsoft customers can run QNSP against Azure Key Vault BYOK + Azure Dedicated HSM as backing custody. | For a Microsoft-shop customer, Key Vault is the path of least resistance for AD-CS PQC (when it ships), M365 integration, Windows Server 2025 CNG, and Azure-native services that expect Azure-native KMS. This is a real and significant Microsoft strength worth acknowledging. |
| Multi-cloud crypto-posture | Crypto-inventory service with 11 cloud-vendor connectors (AWS, Azure, GCP, Alibaba, Akamai, Cloudflare, DigitalOcean, Fastly, IBM, Oracle, HashiCorp Vault). Unified CycloneDX CBOM across the estate. | Azure Key Vault does not discover or inventory non-Azure cryptographic assets. Source: learn.microsoft.com/azure/key-vault/managed-hsm/overview. |
When to pick which
Honest decision guide
Stay on Azure Key Vault if…
- You are 100% Microsoft / Azure and your regulator's PQC timeline aligns with Microsoft's 2029 default-on / 2033 transition roadmap.
- Your data lifecycle is under 7 years and your threat model excludes HNDL (harvest-now-decrypt-later) attacks on long-lived ciphertext.
- Classical RSA / ECC keys are sufficient for your compliance regime through the end of this decade.
Add QNSP on top if…
- You have data with retention beyond 7 years that an adversary could harvest today and decrypt later.
- You're under regulator pressure (MAS TRM, NIST CNSA 2.0 January 2027 deadline, PDPA-binding workloads) to show a PQC migration plan now.
- You need multi-cloud or hybrid-cloud crypto posture beyond Azure-only, or you operate in sovereign / air-gapped environments.
Replace Key Vault with QNSP if…
- You're starting greenfield — no migration cost, get PQC by default on day one.
- You operate in regulated sectors (financial services, government, defence, healthcare) where the auditor is asking about NIST CNSA 2.0 January 2027 today.
- Your application stack uses Python / Go / Rust as much as C# / TypeScript and you want one consistent SDK across languages and clouds.
Verify the QNSP claims
Every claim on this page is independently reproducible
QNSP's algorithm registry, policy tiers, audit-event types, and tier limits are all published at github.com/cuilabs/qnsp-public. The Azure Key Vault claims link to learn.microsoft.com primary documentation and Microsoft Security Blog posts dated April–November 2025 and April 2026. If anything is wrong or outdated, email qnsp-legal@cuilabs.io — we'll re-verify and correct.