Protection

Quantum-safe gateways

The gateway layer is where classical-to-post-quantum translation happens in practice. Quanten deploys inline PQC-capable proxies at network boundaries, performing ML-KEM key exchange on the external-facing side while maintaining existing protocol semantics internally. Sessions established through the gateway carry a cryptographic audit trailAudit trailA tamper-evident record of every key operation. Auditors ask for this, and it is far easier to switch on now than to reconstruct later.: every key exchange event is logged with algorithm identifier, parameter set, and key-material hash, giving compliance teams a complete record without exposing key bytes.

Gateway deployments are stateless: each node holds no long-term key material. ML-KEMML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. encapsulated secrets are forwarded to the HSM or key management cluster for decapsulation, so gateway compromise does not yield usable keying material to an attacker.

HSMHSMA hardware security module: a sealed, tamper-evident box that generates and stores private keys so they never exist in ordinary computer memory. integration and FIPS-140-3 roots of trust

Hardware Security Modules provide the physical root of trust for key generation and storage. Quanten supports HSM-backed deployment paths with FIPS 140-3FIPS 140-3The certification a key-storage device has to pass, covering the hardware itself rather than the maths. It is usually a procurement requirement in regulated sectors.-aligned options and validated modules where they are available for the exact hardware, firmware, and software combination. ML-KEM private key material and ML-DSA signing keys are generated inside the HSM boundary and never leave in plaintext form. For sovereign deployments, HSMs remain on-premises in the client’s jurisdiction, ensuring no key bytes transit international borders.

• FIPS 140-3FIPS 140-3The certification a key-storage device has to pass, covering the hardware itself rather than the maths. It is usually a procurement requirement in regulated sectors.-aligned hardware support
• Air-gappedAir-gappedPhysically disconnected from any network. Keys generated this way cannot be reached remotely at all, because there is no route to them. key generation for classified environments
• On-premises HSMOn-premises HSMA locked-down key vault installed in your own facility, so secret keys stay under your organisation’s physical control. It can also operate without an internet connection. clusters under client jurisdiction
• Key ceremony procedures aligned with NIST SP 800-57

Sovereign key management

Sovereignty over cryptographic material is a legal and operational requirement in regulated sectors. Energy grid operators, financial market infrastructure, and public-sector authorities cannot accept a model where key management is delegated to a third-party cloud provider. Quanten’s key management layer runs entirely within the client environment: key generation, rotation schedules, escrow procedures, and retirement workflows are controlled by the client’s security operations team, with Quanten providing the tooling and the audit interface but no standing access to key material.

Key rotation is automated and non-disruptive: ML-KEMML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today. ephemeral session keys rotate per-handshake by design, while long-term identity keys follow configurable rotation policies from 30 days to 18 months depending on classification level.

Zero-trustZero-trustAn approach where nothing is trusted just because it is inside your network. Every connection has to prove who it is, every time. policy enforcement and SIEM export

Post-quantum cryptography hardens the key exchange layer, but does not replace identity and access controls. Quanten’s zero-trustZero-trustAn approach where nothing is trusted just because it is inside your network. Every connection has to prove who it is, every time. policy engine evaluates device posture, certificate chain validity, and algorithm policy at every connection attempt. Sessions that use deprecated algorithms (RSA, ECDH without PQC hybrid) can be flagged, throttled, or blocked according to policy, giving security teams a migration forcing function with configurable urgency.

All enforcement decisions are exported in structured JSON to your SIEM via syslog or webhook. The audit trailAudit trailA tamper-evident record of every key operation. Auditors ask for this, and it is far easier to switch on now than to reconstruct later. includes the algorithm negotiated, the certificate chain presented, the policy decision taken, and a session token that correlates with upstream application logs. Ready to start? Talk to our security team about mapping your existing zero-trustZero-trustAn approach where nothing is trusted just because it is inside your network. Every connection has to prove who it is, every time. architecture to a PQC-hardened baseline.