Technology · Post-Quantum

Quantum-safe. Today.

Every NIST standard, implemented. ML-KEM for key exchange, ML-DSA for signatures, SLH-DSA for long-term roots, and Corona for threshold post-quantum signing. We don't wait for the quantum threat — we already outran it.

The four pillars

NIST finalized FIPS 203/204/205 in August 2024. We shipped all three the same month.

StandardKind / where we use it

FIPS 203 (ML-KEM, Kyber)

Key encapsulation

TLS handshake, KMS wrapping, MPC transport

FIPS 204 (ML-DSA, Dilithium)

Digital signature (lattice)

Quasar consensus, transaction signatures, JWT

FIPS 205 (SLH-DSA, SPHINCS+)

Hash-based signature

Long-term root CA, backup signer, stateless

Corona (research)

Threshold ML-DSA (N=768)

192-bit threshold signing — our contribution

Threat model

What a capable quantum adversary actually breaks — and why it matters now.

Harvest now, decrypt later

Nation-state adversaries can record encrypted traffic today and decrypt it with CRQCs (cryptographically-relevant quantum computers) in 10-15 years. Classical TLS (ECDHE / RSA-KEM) is already dead for any data with a 10+ year confidentiality horizon.

Blockchain signatures

Every secp256k1 signature on chain reveals the public key. A CRQC extracting the private key from the public key gives arbitrary spend capability — retroactively. We sign every block with both ECDSA and ML-DSA.

Long-term records

Compliance logs, client onboarding data, contract signatures need to survive the transition. We store all long-term records signed with SLH-DSA hash-based signatures — only preimage resistance is assumed.

Hybrid everywhere.

We never throw away classical crypto — we combine it. Every TLS handshake is X25519 + ML-KEM-768. Every block signature is BLS + ML-DSA-65. A future break of either family alone leaves the stack intact. A break of both is still harder than breaking either.

TLS 1.3: X25519-ML-KEM-768 hybrid (NIST SP 800-227 draft)

Noise_XK + ML-KEM for P2P between validators

Consensus: BLS12-381 + ML-DSA-65 dual signatures

Account signatures: secp256k1 + optional ML-DSA attestation

Corona — our contribution.

Threshold post-quantum signing was an open problem: ML-DSA is not naturally thresholdable. Corona is our lattice-based threshold signature scheme with N=768, non-interactive aggregation, and 192-bit security. Open-sourced, audited, already running in production.

192-bit post-quantum security level

Non-interactive threshold (t-of-n) aggregation

Used for Quasar validator signatures

Runs in the same MPC cohort as CGGMP21

EVM precompiles

Smart contracts can verify post-quantum signatures natively — no expensive circuit-in-EVM emulation.

0x0100: ML-DSA verify

FIPS 204 verify at ~50k gas. Drop-in for ecrecover-style flows needing PQ signatures.

0x0101: ML-KEM encapsulate

Sealed-message patterns on chain. Clients post ML-KEM ciphertexts; contracts verify integrity.

0x0102: SLH-DSA verify

Stateless hash-based signature verify. ~180k gas but hash-only security assumption.

Quantum-safe is a shipping concern, not a research one.

Sign your contracts, bridge your assets, and settle your trades with post-quantum crypto available today.