NIST PQC / CNSA 2.0 mappedThe standards we followNIST and CNSA 2.0 are the official rulebooks that say which encryption is strong enough to survive quantum computers. "Mapped" means every algorithm we deploy has been matched to what those rulebooks require.

Encryption built for the quantum era.

Quanten Security delivers post-quantum cryptography as a drop-in fabric, from TLS handshakes to sovereign key storage.

Contact Security Team Read the threat brief
256-bit
Classical security levelHow hard it is to breakA measure of how many keys an attacker would have to try. At 256-bit there are more possible keys than there are atoms in the observable universe, so guessing them one by one is not physically possible.
< 4 ms
PQC handshake latencyThe delay users would feelThe extra time two systems need to agree on a quantum-safe key before any real data moves. Under 4 milliseconds is far quicker than a blink, so visitors never notice it.
3 paths
Deployment patternsThree ways to roll it outYou can run it on your own hardware (On-Premises HSM), as a single-tenant cloud inside your jurisdiction (Sovereign Cloud), or as a layer over the infrastructure you already have (Zero-Trust Overlay).
PQC Handshake · Session 0x8F3AWhat this panel showsA live illustration of two systems opening an encrypted connection. The handshake is the opening negotiation where they agree on secret keys, before a single byte of real data is sent.
AliceAlice, the senderCryptographers always name the first party Alice. In practice she is whatever starts the connection, for example your browser or a banking app. Key material in transitThe travelling dotThe dot represents key material moving between Alice and Bob. The two dashed lines are the two directions of the exchange, since both sides have to contribute before a shared key exists. BobBob, the receiverBob is the second party, for example the server Alice is connecting to. Alice and Bob are the standard stand-in names used to explain how encryption works.
KEMHow they agree on a keyThis is the step where both sides end up holding the same secret key. ML-KEM-1024 is the method NIST standardised for doing it in a way quantum computers cannot unpick. ML-KEM-1024 KAT CHECKEDTested against the official answersKAT stands for Known Answer Test. The implementation was run against NIST's published test cases and produced exactly the results it was supposed to.
SigHow they prove who they areA digital signature stops an impostor from posing as Bob. Two run at once here: ML-DSA-87 is the quantum-safe one, and Ed25519 is the long-trusted classical one, so the connection holds up either way. ML-DSA-87 + Ed25519 KAT CHECKEDTested against the official answersKAT stands for Known Answer Test. The implementation was run against NIST's published test cases and produced exactly the results it was supposed to.
SharedThe key they both ended up withThis secret is never sent across the wire. Each side works it out independently, so someone who recorded the entire exchange still cannot reconstruct it. 7f 3a c2 ··· 9e 4b 1d SEALEDThe channel is closed to outsidersThe key exchange finished successfully, so everything sent from this point on is encrypted with the shared secret.
EntropyWhere the randomness comes fromKeys are only as unguessable as the randomness used to make them. A quantum random number generator (QRNG) draws that randomness from physics rather than from a software formula an attacker could predict. QRNG · vacuum-shot 98.4%How random the source really isA score for how close the randomness measures to perfect. The nearer it sits to 100 percent, the less any pattern is left for an attacker to exploit.
Standards and evidence signals
Standards mapping NIST PQC / CNSA 2.0The standards we followNIST and CNSA 2.0 are the official rulebooks that say which encryption is strong enough to survive quantum computers. "Mapped" means every algorithm we deploy has been matched to what those rulebooks require. mapped Migration scope TLS, PKI, firmware signingFirmware signingSigning the software burned into a device so it will refuse anything tampered with. Devices live for a decade or more, so their signatures need to outlast the quantum transition. Key custody FIPS 140-3FIPS 140-3The certification a key-storage device has to pass, covering the hardware itself rather than the maths. It is usually a procurement requirement in regulated sectors.-ready HSM paths Evidence review Readiness artefactsReadiness artefactsThe documents an auditor or customer asks for as proof: test results, algorithm inventories, and migration plans. We hand them over on request. on request
Platform

Three pillars. One crypto-agileCrypto-agilityBeing able to swap one encryption algorithm for another without rebuilding your systems. It is what turns the next migration into a configuration change instead of a project. fabric.

Platform overview
01

Post-Quantum Key ExchangePost-quantum key exchangeTwo systems create the same secret code when they connect, without putting that code on the network. The method is designed so a future quantum computer cannot reconstruct it.

ML-KEM-1024ML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. replaces ECDHECDHThe method almost every encrypted connection uses today to agree on a secret key. It is one of the two things a quantum computer would break, which is why ML-KEM replaces it. across every session: TLS, SSH, and proprietary tunnels.

  • FIPS 203FIPS numbersFIPS is the US government publication series that makes an algorithm official. A FIPS number means the algorithm is approved for real deployment, not still a proposal. aligned
  • Hybrid ECDHHybrid modeRunning a classical and a quantum-safe algorithm side by side, so the connection stays secure as long as either one holds. It is the recommended way to cross the transition period. + ML-KEMML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. mode
  • < 4 ms latency overhead
  • Drop-in HSMHSMA hardware security module: a sealed, tamper-evident box that generates and stores private keys so they never exist in ordinary computer memory. support
02

Lattice-Based SignaturesLattice-based signaturesA digital seal attached to data or software. It proves who sent it and shows if anything changed, using grid-like mathematics designed to withstand quantum computers.

ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. and SLH-DSASLH-DSAA second quantum-safe signature built on a completely different kind of maths to ML-DSA. It is slower, and it exists as a fallback in case a weakness is ever found in the first approach. sign every packet and firmware image with quantum-safe math.

  • FIPS 204FIPS numbersFIPS is the US government publication series that makes an algorithm official. A FIPS number means the algorithm is approved for real deployment, not still a proposal. / 205 aligned
  • Dual-signature bridge mode
  • Hardware-rootedHardware-rooted trustThe chain of trust starts in a physical chip rather than in software. Software can be rewritten by an attacker who gets in; the chip cannot. trust chain
  • Zero-trustZero-trustAn approach where nothing is trusted just because it is inside your network. Every connection has to prove who it is, every time. policy engine
03

Crypto-Agility EngineCrypto-agilityBeing able to swap one encryption algorithm for another without rebuilding your systems. It is what turns the next migration into a configuration change instead of a project.

Algorithm profiles hot-swap without downtime. Quantum or classical: the fabric adapts.

  • Algorithm negotiationAlgorithm negotiationTwo systems agreeing which algorithm to use at the moment they connect, rather than having it hard-coded. It is what lets you change algorithm later without touching the applications. API
  • CNSA 2.0The standards we followNIST and CNSA 2.0 are the official rulebooks that say which encryption is strong enough to survive quantum computers. "Mapped" means every algorithm we deploy has been matched to what those rulebooks require. policy templates
  • Live migrationLive migrationMoving to a new algorithm while the service keeps running. No maintenance window, no downtime to schedule with the business. support
  • Audit trailAudit trailA tamper-evident record of every key operation. Auditors ask for this, and it is far easier to switch on now than to reconstruct later. + SIEMSIEMThe security monitoring system a team already watches alerts in. Exporting to it means this fabric shows up where your analysts are looking, rather than in yet another dashboard. export
Algorithms

NIST-standardised. Deployment-mapped.

Full algorithm matrix
A.01
ML-KEM-1024ML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today.CRYSTALS-KyberCRYSTALS-KyberThe original research name for what NIST standardised as ML-KEM. Same algorithm, older label, still common in documentation. · FIPS 203FIPS numbersFIPS is the US government publication series that makes an algorithm official. A FIPS number means the algorithm is approved for real deployment, not still a proposal.
LatticeLattice-based cryptographySecurity built on questions about points in a huge multi-dimensional grid. No quantum shortcut is known for these questions, which is why the main new standards use them.ACTIVEActiveStandardised and deployable now. You can put this into production today rather than waiting on a committee.
A.02
ML-DSA-87ML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered.CRYSTALS-DilithiumCRYSTALS-DilithiumThe research name for what became ML-DSA. If a datasheet says Dilithium and a standard says ML-DSA, they mean the same thing. · FIPS 204
LatticeLattice-based cryptographySecurity built on questions about points in a huge multi-dimensional grid. No quantum shortcut is known for these questions, which is why the main new standards use them.ACTIVEActiveStandardised and deployable now. You can put this into production today rather than waiting on a committee.
A.03
SLH-DSA-SHA2-256sSLH-DSAA second quantum-safe signature built on a completely different kind of maths to ML-DSA. It is slower, and it exists as a fallback in case a weakness is ever found in the first approach.SPHINCS+SPHINCS+The research name for SLH-DSA. It is the conservative fallback signature, built only from hash functions. · FIPS 205
HashHash-based cryptographySecurity built only on hash functions, the well-understood building blocks already used everywhere today. Very conservative, and slower as a result.ACTIVEActiveStandardised and deployable now. You can put this into production today rather than waiting on a committee.
A.04
FN-DSA (Falcon)FN-DSA (Falcon)A quantum-safe signature that produces unusually small signatures, which matters for constrained devices. The standard is still being finalised.FIPS 206FIPS numbersFIPS is the US government publication series that makes an algorithm official. A FIPS number means the algorithm is approved for real deployment, not still a proposal. in development
LatticeLattice-based cryptographySecurity built on questions about points in a huge multi-dimensional grid. No quantum shortcut is known for these questions, which is why the main new standards use them.PENDINGPendingSelected but not yet finalised as a standard. Worth planning around, not yet worth depending on.
A.05
HQC-256HQC-256A backup key-exchange method NIST selected precisely because it relies on different maths to ML-KEM. If one family were ever broken, the other should still stand.NIST-selected backup KEM
CodeCode-based cryptographySecurity built on error-correcting codes, the same maths that lets a scratched disc still play. It is a well-studied alternative to lattices.PENDINGPendingSelected but not yet finalised as a standard. Worth planning around, not yet worth depending on.
A.06
Classic McElieceClassic McElieceOne of the oldest quantum-resistant designs, unbroken since the 1970s. Its keys are very large, which is why it stays in research use rather than everyday traffic.Research-only code-based KEM
CodeCode-based cryptographySecurity built on error-correcting codes, the same maths that lets a scratched disc still play. It is a well-studied alternative to lattices.PENDINGPendingSelected but not yet finalised as a standard. Worth planning around, not yet worth depending on.
Q-Day planning horizonQ-DayShorthand for the day a quantum computer can break the encryption in use today. Nobody knows the date, so planners work to a window rather than a deadline. 1,226 days

Migration planners commonly model cryptographically relevant quantum risk across a 2029–2033 window.

Post-quantum encryption
ML-KEM-1024ML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. FIPS 203FIPS numbersFIPS is the US government publication series that makes an algorithm official. A FIPS number means the algorithm is approved for real deployment, not still a proposal. key encapsulation
Hybrid TLSHybrid modeRunning a classical and a quantum-safe algorithm side by side, so the connection stays secure as long as either one holds. It is the recommended way to cross the transition period. 1.3 ECDHECDHThe method almost every encrypted connection uses today to agree on a secret key. It is one of the two things a quantum computer would break, which is why ML-KEM replaces it. + ML-KEMML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. migration mode
AES-256AES-256The encryption that protects stored data and the contents of a connection. Quantum computing weakens it but does not break it, so AES-256 stays safe to keep using. Symmetric data encryption remains safe
ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. / SLH-DSASLH-DSAA second quantum-safe signature built on a completely different kind of maths to ML-DSA. It is slower, and it exists as a fallback in case a weakness is ever found in the first approach. Post-quantum identity signatures
RSA-2048RSA-2048The encryption behind a large share of today's web traffic, VPNs, and digital certificates. A sufficiently capable quantum computer would break it outright. BROKENBrokenA quantum computer of sufficient scale would defeat this outright. Not broken today, but anything encrypted with it now can be opened later.
ECC-P256ECC-P256The other workhorse of today's internet encryption, used widely in mobile and messaging. It falls to the same quantum attack as RSA. BROKENBrokenA quantum computer of sufficient scale would defeat this outright. Not broken today, but anything encrypted with it now can be opened later.
AES-256AES-256The encryption that protects stored data and the contents of a connection. Quantum computing weakens it but does not break it, so AES-256 stays safe to keep using. SAFESafeExpected to hold up against quantum attack. Either quantum computing barely dents it, or it was designed specifically to resist it.
ML-KEM SAFESafeExpected to hold up against quantum attack. Either quantum computing barely dents it, or it was designed specifically to resist it.
Quantum Physics

Why lattice math survives quantum attack.

ShorShor's algorithmThe quantum method that breaks RSA and ECC. It is the specific reason today's public-key encryption has an expiry date.'s algorithm solves the discrete-logarithm and integer-factorisation problems in polynomial time on a quantum computer. Every algorithm that relies on these problems (RSA, ECC, DH) falls.

Lattice problems such as Learning With ErrorsLearning With ErrorsThe hard problem underneath lattice cryptography: recovering a hidden pattern once deliberate noise has been added. Adding that noise is easy, and undoing it is believed to be beyond quantum computers too. (LWE) have no known quantum speedup. ML-KEM and ML-DSA are built on LWE hardness, giving post-quantum security without sacrificing performance.

Security model
IND-CCA2IND-CCA2The strongest standard goal for encryption. Even an attacker allowed to feed the system messages of their own choosing learns nothing at all about what a scrambled message contains.
Lattice problem
Module-LWEModule-LWEThe exact hard problem ML-KEM and ML-DSA are built on, a structured form of Learning With Errors. The structure keeps keys small and the maths quick with no known cost to security.
Classical bits
256Classical bitsStrength measured against an ordinary computer, as the number of key bits an attacker would have to work through. At 256 that is far beyond anything reachable.
PQ bits
232Post-quantum bitsThe strength left once a working quantum computer is assumed. It sits a little under the classical figure, which is expected, and still leaves an enormous margin.
Atom animationWhat this animation showsElectrons circling a nucleus, the familiar picture of an atom. It stands for the quantum hardware these algorithms have to withstand, not for the encryption itself. Superposition formulaSuperpositionA quantum bit is not simply 0 or 1. It holds both at once, and the two symbols say how much of each is in the mix. That is where a quantum computer gets its power, because it works through many possibilities together. Energy equationThe energy equationThis says how much energy a particle has, which is what decides how it moves from one moment to the next. It is the rule driving the electrons in this animation. Measurement probabilityThe odds of each answerReading a quantum bit forces it to settle on 0 or 1. This gives the chance of it landing on 0, turning the amount of 0 in the mix into an ordinary probability. Wavelength of matterMatter behaves like a waveEvery particle has a wavelength, shorter the faster and heavier it is. It is the reason electrons spread into the shells drawn here instead of sitting still like tiny balls.
Deploy

Three paths. Zero forklift upgrades.

Deployment guide

On-Premises HSMOn-premises HSMA locked-down key vault installed in your own facility, so secret keys stay under your organisation's physical control. It can also operate without an internet connection.

Air-gappedAir-gappedPhysically disconnected from any network. Keys generated this way cannot be reached remotely at all, because there is no route to them. key generation and storage. FIPS 140-3FIPS 140-3The certification a key-storage device has to pass, covering the hardware itself rather than the maths. It is usually a procurement requirement in regulated sectors.-ready HSMHSMA hardware security module: a sealed, tamper-evident box that generates and stores private keys so they never exist in ordinary computer memory. workflow with tamper evidence.

qs-keygen --algo ml-kem-1024 --hsm

Sovereign CloudSovereign cloudA private cloud kept in a country or region you choose. This helps meet rules about where data and keys are allowed to stay, and no other customer shares the environment.

Single-tenant deployment in your jurisdiction. National data-residency requirements met.

qs deploy --mode sovereign --region eu-west

Zero-Trust OverlayZero-trust overlayA protective layer added around the systems you already run. It checks every connection and adds quantum-safe encryption without requiring those systems to be replaced.

Drop the PQC fabric over existing infrastructure. mTLSmTLSMutual TLS: both sides of a connection prove their identity to each other, not just the server to the client. It is a common building block of zero-trust networks. + ML-KEMML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. without forklift upgrades.

qs overlay --target 10.0.0.0/8 --pqc hybrid
FAQ

Common questions. Direct answers.

Full documentation
Q.01

When does our current PKIPKIThe certificate system that proves a server or a person is genuine. Every certificate is signed, so a quantum-safe signature has to reach all of them. become quantum-vulnerable?

Migration planners commonly model cryptographically relevant quantum risk across a 2029–2033 window. RSA-2048RSA-2048The encryption behind a large share of today's web traffic, VPNs, and digital certificates. A sufficiently capable quantum computer would break it outright. and ECC-P256ECC-P256The other workhorse of today's internet encryption, used widely in mobile and messaging. It falls to the same quantum attack as RSA. would be broken retroactively once a capable quantum computer exists — any encrypted traffic captured today can be decrypted then.

Q.02

What is “harvest now, decrypt later”?

Nation-state adversaries are recording encrypted sessions now. Once a quantum computer arrives, stored ciphertext becomes plaintext. PQC migration cannot wait until Q-DayQ-DayShorthand for the day a quantum computer can break the encryption in use today. Nobody knows the date, so planners work to a window rather than a deadline. arrives.

Q.03

Does PQC add latency?

ML-KEM-1024ML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. handshakes add less than 4 ms over baseline TLS 1.3TLSThe protocol behind the padlock in a browser. It encrypts traffic between a visitor and a website, and it is the single biggest place post-quantum encryption has to land. on commodity hardware. Key-share payloads are larger (1,568-byte encapsulation key plus 1,568-byte ciphertext, vs 32 bytes for ECDH), but modern networks absorb the roughly 3.1 KB PQC exchange.

Q.04

Is hybrid PQC + classical mode available?

Yes. Quanten's fabric runs dual-algorithm sessions — classical ECDHECDHThe method almost every encrypted connection uses today to agree on a secret key. It is one of the two things a quantum computer would break, which is why ML-KEM replaces it. alongside ML-KEMML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. — so you remain protected against both classical and quantum attackers during the migration window.

Blog

Latest from the blog

All posts
Quantum computing chamber facing encrypted infrastructure and a post-quantum migration horizon. 07

The 2029 quantum-security wake-up call

3 min read

Google and Cloudflare have pulled their post-quantum migration targets toward 2029. The lesson for enterprises is not panic; it is that authentication, signing, and crypto inventory need executive attention now.

Read post
SECURE CONTACT CHANNEL

Begin your quantum-safe migration.

Share your environment, timeline, and regulatory context. The team will route your request to the right specialist without collecting unnecessary telemetry.

Do not include classified material, credentials, private keys, or regulated secrets in this form.