02 Security · Post-Quantum
Build the key for the decade after this one.
Traffic recorded today is decrypted whenever the key falls. QERYX keys rest on ML-KEM-1024 — a lattice problem no known quantum algorithm touches.
01The deadline — CNSA 2.0, 1 January 2027
Read the clock off a standards document.
CNSA 2.0 sets January 1, 2027 as the gate for post-quantum algorithms in new National Security Systems acquisitions. The threat it prices in is harvest-now-decrypt-later: an adversary records ciphertext today and waits for a cryptanalytically relevant quantum computer. Expert surveys place that machine years away, not decades1 — and a message worth recording is worth recording for years.
CNSA 2.0 — asymmetric core conformant (ML-KEM-1024 + ML-DSA-87 at Category V; SHA-512 at or above the hash floor). Production AEAD today is ChaCha20-Poly1305 (RFC 8439), a documented deviation; the AES-256-GCM NSS suite is implemented and reserved as suite 0x0002, staged for rollout. Pre-evaluation checklist: 0 non-conformant findings, 3 documented deviations (NIAP ETR, 2026-05).
02Primitives — Category V, the widest set FIPS defines
Count the bytes. Both primitives ship at Category V.
Both ship at the largest standardized parameter set — Category V, the highest security category FIPS defines.
| Primitive | Standard | Role | Public key | Output |
|---|---|---|---|---|
| ML-KEM-1024 | FIPS 203 | Key encapsulation | 1568 B | 32 B shared secret |
| ML-DSA-87 | FIPS 204 | Identity signatures | 2592 B | 4627 B signature |
| X25519 | RFC 7748 | Classical hybrid half | 32 B | 32 B shared secret |
Why Category V and not a lighter set?
Category V parameters (ML-KEM-1024, ML-DSA-87) are sized so that breaking them is at least as hard as brute-forcing AES-256. Lighter sets trade margin for bytes; on a message that must stay sealed for decades, margin wins. The cost is real — a 1568-byte encapsulation key instead of 32 — and the wire format pays it on every handshake.
What implements them?
Every ML-KEM and ML-DSA operation dispatches to a library lineage holding FIPS 140-3 cert #4631. Algorithm-conformant; QERYX’s own module is not yet CMVP-certified. The unmaintained research crates were removed in the 2026-04 migration after published timing-leak results against them.
03The hybrid floor — break one half, the other holds
Break one half. The other still holds.
Every session key derives from both X25519 and ML-KEM-1024 through HKDF-SHA-512. If lattice cryptanalysis advances, X25519 holds; if a quantum computer arrives, ML-KEM-1024 holds. Breaking a session requires breaking both X25519 and ML-KEM-1024.
The combiner is X-Wing-style concatenation over HKDF-SHA-512 in the NIST SP 800-227 §6.2 shape. We publish our own caveat: we do not claim the X-Wing IND-CCA2 proof at the -1024 parameter set. The full formula, verbatim from crypto-core, is printed on /technology.
04The record — the questions we get asked hardest
The hard questions.
Is post-quantum crypto proven against a real quantum computer?
No such machine exists to test against, and we say so. ML-KEM rests on the Module-LWE lattice problem, which resists every known quantum algorithm including Shor’s and Grover’s. That is the honest strength of the claim — hardness against known attacks, chosen at the widest standardized margin, hybridized so X25519 backstops it.
Does the AEAD need to be post-quantum too?
Symmetric ciphers survive quantum attack with their key size halved by Grover’s algorithm; a 256-bit ChaCha20-Poly1305 key retains 128-bit quantum security. The asymmetric handshake is the surface a quantum computer breaks — which is where ML-KEM-1024 stands.