Sovereignty over Cryptographic Methods & Crypto-Agility
Why important?
Sovereignty requires traceable, replaceable and EU-compliant cryptographic methods.
How measured?
Scale 0–5 + N/A:
- 0 = Methods/libraries not transparent; no choice of algorithm; dependency on non-EU crypto services.
- 1 = Standard methods, but no transparency on implementation and no configurability.
- 2 = Disclosed, standards-compliant methods (e.g. BSI TR-02102), only partly configurable.
- 3 = Configurable, standards-compliant methods; switching algorithms possible in principle without lock-in.
- 4 = Full configurability and crypto agility; no mandatory dependency on non-EU crypto/KMS services.
- 5 = Demonstrated control over methods incl. PQC readiness and verifiable crypto agility; fully EU-compliant, replaceable crypto layer.
- N/A = no reliable evidence
Sources / Evidence
Validation questions (RFP)
- Which algorithms and key lengths are used, do they follow BSI TR-02102, and can customers specify them? Is there a documented post-quantum cryptography plan (e.g. ML-KEM, hybrid schemes) with a timeline? How quickly can a compromised algorithm be replaced?
Scores comparison
| Provider | Score | |
|---|---|---|
| STACKIT | 4.0 | Documented standard methods (AES-256-GCM, RSA-2048/3072/4096), configurable, operated in EU/DE, no non-EU KMS dependency; confidential computing as additional hardening; PQC not stated. (stated) |
| OVHcloud Public Cloud (inkl. SecNumCloud) | 4.0 | Open source KMS SDK + KMIP interoperability (keys transferable to other KMS), RFC 7518 signatures, configurable; SecNumCloud (ANSSI crypto requirements); EU/FR. High control over methods/agility. (stated) |
| T Cloud Public | 4.0 | KMS with HSM-protected root keys and documented standard algorithms (AES-256, HMAC-SHA-256/384/512, RSA-2048/3072/4096, EC P-256/P-384); import of own key material (BYOK) with local backup; operated in DE. Limits: CMKs cannot be exported, KMS-generated material cannot be updated, no PQC documented. (stated) |
| AWS European Sovereign Cloud | 3.0 | Standardised methods (TLS/AES/KMS), configurable, but AWS-proprietary implementation; in ESC an EU-operated KMS, no mandatory non-EU dependency; PQC partly. (stated) |
| Oracle EU Sovereign Cloud | 3.0 | Standard methods, PKCS#11 interfaces, configurable; EU realm; FIPS L3. TLS 1.2 as default (note). (stated) |
| pluscloud open | 3.0 | Open SCS/OpenStack stack: standard-compliant, configurable methods without lock-in; EU/DE. (stated) |
| Scaleway | 3.0 | Documented methods (HKDF/SHA-256, AES, asymmetric, signature), API-driven, configurable; EU/FR, no non-EU dependency. (stated) |
| Delos Cloud | 3.0 | Azure crypto stack + D-Trust trust services (DE); configurable; operated within the DE boundary. (stated) |
| Microsoft Sovereign Cloud | 3.0 | Azure standard methods, broadly configurable, PQC roadmap; KMS in an EU region, but Azure-proprietary. (stated) |
| noris Sovereign Cloud | 3.0 | Open OpenStack stack: configurable, standard-compliant methods without lock-in; EU/DE. (stated) |
| SysEleven OpenStack Cloud | 3.0 | Open OpenStack stack: configurable methods without lock-in; EU/DE. (stated) |
| Cloud Temple Trusted Cloud | 3.0 | SecNumCloud requires ANSSI-qualified cryptographic methods (strong EU/FR crypto governance); Stormshield. EU/FR. (stated) |
| Infomaniak Public Cloud | 3.0 | Open OpenStack stack: configurable methods; operated in CH. (stated) |
| IONOS Cloud | 2.0 | Standard methods without documented configurability/crypto agility; operated in EU/DE. (unclear) |
| UpCloud | 2.0 | Standard methods without documented configurability/agility; EU/FI. (unclear) |
| Exoscale | 2.0 | Standard methods without documented agility; EU/CH. (unclear) |
| Hetzner Cloud | 2.0 | Own stack without documented crypto governance; customer-side cryptography freely selectable; EU/DE. (unclear) |