03 Science — the lattice floor
Two clouds. One lattice. One secret.
Two independent systems converge on one shared secret. The hard problem holding it up is noise in a lattice — and it holds against every published quantum algorithm.
01Feel & touch — two clouds, one lattice
Scroll. The agreement runs as you pass.
Two particle clouds drift on independent fields. As you scroll they converge, site by site, into one shared crystal — two parties arriving at one secret without ever sending it.
03Understand — Module-LWE, FIPS 203 parameters
Noise is the wall.
One equation carries the whole construction. Add small noise to a linear system and recovering the secret becomes the Module-LWE problem — the foundation FIPS 203 standardizes.
b = A·s + e (mod q) A public matrix s secret e small noise
Without e, this is high-school linear algebra. With e, recovering s from (A, b) is a lattice problem: no published classical or quantum algorithm breaks it at ML-KEM-1024 parameters.
| Parameter | Value | Source |
|---|---|---|
| Ring | Z_q[X] / (X²⁵⁶ + 1) | FIPS 203 |
| Modulus q | 3329 | FIPS 203 |
| Module rank k | 4 | FIPS 203 |
| Noise (η₁, η₂) | 2, 2 | FIPS 203 |
| Encapsulation key | 1568 bytes | FIPS 203 |
| Ciphertext | 1568 bytes | FIPS 203 |
| Shared secret | 32 bytes | FIPS 203 |
| Security category | 5 — the highest defined | FIPS 203 |
ss = SHA3-256( ss_X25519 ‖ ss_ML-KEM ‖ transcript )
Simplified schematic — the shipped combiner is X-Wing-style over both shared secrets and the handshake transcript. We do not claim the X-Wing IND-CCA2 proof at the -1024 parameter set; that caveat is published alongside the spec.
Why does noise make it hard?
Each equation in the system is slightly wrong, and the errors compound: solving for s becomes finding the closest point in a 1024-dimensional lattice. The best known attacks — classical and quantum — cost exponentially in that dimension.
Why keep X25519 at all?
The hybrid holds unless both halves fall. If lattice cryptanalysis moves, X25519 still stands; when a large quantum machine arrives and Shor's algorithm takes X25519, ML-KEM-1024 stands. Breaking a session requires breaking both X25519 and ML-KEM-1024.
- NIST, "Module-Lattice-Based Key-Encapsulation Mechanism Standard," FIPS 203 (August 2024)
- O. Regev, "On lattices, learning with errors, random linear codes, and cryptography," STOC (2005)
- P. W. Shor, "Algorithms for quantum computation: discrete logarithms and factoring," FOCS (1994)
04The deadline — harvest now, decrypt later
Recorded today, decrypted whenever the machine arrives.
Ciphertext is cheap to store. Anything sealed under classical key agreement alone waits for the machine that runs Shor's algorithm at scale. The standards bodies answered with a schedule: FIPS 203 and FIPS 204 were finalized in August 2024. QERYX ships both today.
Precision note This is not QKD. Not quantum networking. Not quantum teleportation. We do not violate the no-communication theorem. We bind a key-derivation function to a verifiable physical measurement no classical adversary can fabricate in advance.
05In QERYX — every pairing, every session
Follow the floor into the protocol.
Every pairing and every session runs the X25519 + ML-KEM-1024 hybrid agreement — the convergence you scrolled through above. Identities are signed with ML-DSA-87 (FIPS 204), lattice mathematics of the same family.
Above this floor sits Bell-binding — a verifiable measurement folded into key derivation, never a replacement for it. The floor you just read is what a session's security rests on.
06The record — the questions we get asked hardest
The honest questions.
Is a quantum computer breaking X25519 today?
No publicly known machine runs Shor's algorithm at that scale today. The threat with a date on it is harvest-now-decrypt-later: recordings made this year meet whatever machine exists in twenty. That is a schedule question, and the standards schedule has already answered it.
Is the particle field above a simulation of ML-KEM?
It is a visual metaphor and labeled as one — two independent systems converging on one shared structure. The equations and parameters on this page are the real construction; the field is the feel, the math is the proof.
What signs the identities?
ML-DSA-87 (FIPS 204) identity signatures. The transparency log carries three Ed25519 auditor slots, dormant until auditors are onboarded.