Cosmian covercrypt

Cosmian covercrypt is a post-quantum public key encryption scheme designed to provide fine-grained data access control through attribute-based encryption.

Reviewed by 7wData

On this page

Publisher review

Cosmian covercrypt is a post-quantum public key encryption scheme designed to provide fine-grained data access control through attribute-based encryption. Built in Rust and standardized under ETSI TS 104 015 (approved February 2025), it combines classical and NIST post-quantum algorithms (Kyber hybridization) to protect sensitive data against both current and future quantum computing threats. The technology implements a Key Encapsulation Mechanism with Access Control (KEMAC) that allows organizations to encrypt data partitioned by attributes—such as department and classification level—and generate decryption keys tied to specific access policies.

Cosmian covercrypt achieves encapsulation in ~200 microseconds and decapsulation in ~600 microseconds, enabling seamless integration into enterprise systems without performance degradation. Unlike traditional attribute-based encryption, covercrypt embeds access policies within encrypted data, preventing unauthorized actors from learning the intended recipients through traffic analysis. The tool supports JavaScript, Java, Python, Flutter/Dart, C++, and Apache Spark libraries, with both native implementations and KMS-backed deployments available.

Founded in 2018 and headquartered in Paris, Cosmian partnered with Atos subsidiary Eviden in 2025 to offer sovereign encryption solutions combining covercrypt with hardware security modules. The standardization milestone positions it as one of the first commercially available, standards-compliant post-quantum functional encryption solutions for enterprises managing sensitive data in regulated sectors including finance, defense, and healthcare.

Get the AI & data signal, daily.

48k+ subscribers read this every morning. One email, both newsletters. Unsubscribe anytime.

How it works

  1. Hybrid post-quantum encryption

    Combines classical DDH with NIST-approved Kyber for quantum-resistant data protection, addressing long-term confidentiality risks.

  2. Hidden access policies

    Embeds encryption access policies within ciphertext, preventing adversaries from performing traffic analysis to learn authorized recipients.

  3. Fine-grained attribute partitioning

    Enables hierarchical access control using multiple attribute axes (e.g., department + clearance level), with efficient attribute rotation for selective partition refreshing.

  4. High-performance encapsulation

    Achieves ~200 microsecond encapsulation and ~600 microsecond decapsulation, enabling integration into latency-sensitive enterprise workflows without native KMS roundtrips.

  5. Forensic traceability

    Generates unique key fingerprints for each user even with identical access rights, supporting non-repudiation and breach investigation.

  6. Multi-platform SDK support

    Provides native libraries for JavaScript, Java, Python, Flutter, C++, and Apache Spark with open-source reference implementations on GitHub.

  7. ETSI standardization (TS 104 015)

    International standard endorsement ensures vendor-neutral, secure interoperability and regulatory confidence for EU and government deployments.

Strengths and trade-offs

Strengths

  • First ETSI-standardized solution combining functional encryption with post-quantum security; addresses standards gap in emerging cryptography.
  • Hidden access policies provide stronger privacy guarantees than traditional CP-ABE variants (e.g., Cloudflare CIRCL), preventing traffic analysis attacks.
  • Native library implementations deliver sub-millisecond performance without HSM roundtrips, practical for scale-intensive data lakes and streaming workflows.

Trade-offs

  • Limited vendor ecosystem: Cosmian's 2025 Eviden partnership is recent; adoption remains narrow outside European financial/government sectors versus mature TDE solutions.
  • Attribute management complexity: Fine-grained policies require careful schema design; mistakes in axis hierarchy or rotation policies can lock users out or over-share permissions.
  • No transparent public pricing; enterprise licensing model typical for cryptography tools; cost-benefit analysis difficult for smaller organizations evaluating attribute-based encryption ROI.

Pricing context

Cosmian covercrypt pricing is not publicly listed; commercial deployment follows enterprise software licensing with per-CPU or per-instance models common in the cryptography category. The related Cosmian KMS uses per-CPU pricing with no hidden connector costs. Organizations typically obtain quotes directly from Cosmian or through partners like Eviden (Atos).

Open-source reference implementations available on GitHub enable prototyping before commercial licensing. Positioning targets financial institutions, government agencies, and healthcare providers prioritizing sovereign, standards-compliant encryption over cost minimization.

Alternatives

User reviews

No user reviews yet. Be the first to write one.

Sources

Reporting on this tool draws on these publicly available sources.

  1. cosmian.com — Product overview, feature description, and Eviden partnership context
  2. docs.cosmian.com — Technical specifications, performance metrics, supported platforms (JS, Java, Python, Dart, C++, Spark), attribute-based encryption mechanics, and attribute rotation
  3. cosmian.com — ETSI TS 104 015 standardization approval (February 2025), KEMAC scheme, hybrid encryption design, and quantum-resistant protection rationale
  4. eprint.iacr.org — Covercrypt cryptographic design, DDH/LWE hybrid assumptions, early-abort KEM architecture, and traceability properties
  5. www.globenewswire.com — Eviden partnership announcement (April 2025), sovereign HSM integration, and key management system deployment context
  6. thequantuminsider.com — Post-quantum cryptography market adoption trends in 2025–2026, including major vendor integration and enterprise deployment timelines