quantakrypto
Loading…
Loading…
Audit reports, research, methodology, and conformance notes: what we find at the protocol and architecture layer, written so it generalises.
38 articles
We reviewed the most widely used pure-JavaScript post-quantum library twice, six days apart, and found eighteen defects. Not one of them is in the maths. The first round was merged in two hours; the second found twelve more in the repaired code; then the maintainer read our patches and found two defects in them.
The most serious finding in our review of the Dart Nostr Development Kit was not cryptographic. It was a GPL-3.0-only crate inside an MIT-licensed SDK. Compiled into every application that depended on the SDK, whether or not that application used post-quantum code at all. All five findings are now fixed and shipped in ndk 0.9.0.
A product sold on FIPS 203 ML-KEM was shipping a pre-standard Kyber variant, at a lower security level than its own datasheet claimed. So we measured it. The cryptography underneath was sound, the runtime reported an algorithm string matching neither, and four of six findings are now closed.
Nine days ago we published a proposal for giving a Nostr identity post-quantum keys, derived from its seed phrase where it has one. It is now running in a chat client anyone can open. Obelisk sends gift-wrapped direct messages carrying an ML-KEM-1024 payload, against public relays, with no relay changes and no changes required of clients that do not opt in. The four specification drafts are public. So is the bug we shipped and caught, which was in the routing rather than the cryptography.
Check Point Research disclosed that the North Korea-linked Lazarus Group used ML-KEM, the NIST-standardized post-quantum key encapsulation mechanism, to protect the delivery channel for a Windows kernel zero-day (CVE-2026-68820) in its Operation Dream Job campaign against defense and aviation firms. Microsoft patched the flaw in its August 2026 Patch Tuesday release, the only bug that month it flagged as actively exploited. The notable part is not quantum computers, it is that a well-reviewed, standardized primitive is now common enough that attackers reach for it too.
The IETF has published RFC 10024, formally standardizing X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 as hybrid post-quantum key agreement mechanisms for TLS 1.3. The three groups replace the long-running draft-ietf-tls-ecdhe-mlkem specification that browsers and libraries were already shipping as a de facto default. Here is what the RFC locks in, and what it still leaves for a separate migration.
In 2026, thieves emptied thousands of hardware wallets without breaking any of Bitcoin's cryptography. They just guessed the keys. Here is how that is possible, explained plainly, and the one simple thing that saved the people who did it.
Every encrypted Nostr message published today is a future plaintext. We are proposing a NIP, jointly with nostr-wot, that lets an identity derive post-quantum keys from its seed phrase where it has a 24-word one - so those words still restore the identity after the transition. Accounts without one, which is most of them, generate an independent key that needs its own backup. It is implemented and running against public relays, not a design document: you can send a post-quantum encrypted message and take it apart layer by layer.
Cloudflare now supports post-quantum authentication between its edge and your origin server: Authenticated Origin Pulls and Custom Origin Trust Store both accept ML-DSA (FIPS 204) certificates. Paired with the X25519MLKEM768 key exchange already running on that hop, this is the first mainstream path to a fully post-quantum CDN-to-origin connection, not just the browser-to-edge leg.
On July 28, 2026, Anthropic disclosed that its Claude Mythos Preview model found a structural weakness in HAWK, a lattice-based signature scheme in the third round of NIST's additional-signatures process. The flaw cut the estimated key-recovery cost for the smallest parameter set by roughly a million times, and the HAWK team withdrew the candidate days later. None of NIST's finalized standards, ML-KEM, ML-DSA, and SLH-DSA, are affected.
Go 1.27, released this month, adds a crypto/mldsa package implementing ML-DSA (FIPS 204), plus ML-DSA support in crypto/x509 and crypto/tls. Post-quantum signatures are no longer a third-party dependency for Go services, they are a standard-library import. Here is what shipped and what it means for the migration.
By late 2025, around 43% of human web connections to Cloudflare were already using hybrid post-quantum key agreement, and X25519MLKEM768 is on by default in every major browser. The browser-to-edge hop is largely migrated. The unfinished half is origins, authentication, and your own stack. Here is where the line actually is.
Chrome has negotiated hybrid post-quantum key agreement by default since version 131 in November 2024, migrating from a pre-standard Kyber draft to the finalized X25519MLKEM768. The other major browsers and libraries followed. Here is how the switch happened, and what the hybrid does and does not protect.
NIST's transition report, IR 8547, names the dates the whole migration is timed against: today's public-key algorithms deprecated after 2030 and disallowed after 2035. Those are not distant abstractions, they are a schedule you have to work backwards from. Here is what the deadlines say and what they mean.
CISA, with the NSA, FBI, and international partners, replaced the 2021 NTIA baseline for what a software bill of materials must contain. The new floor asks for cryptographic hashes on every component, a signature on the SBOM itself, full transitive-dependency depth, and machine-processable identifiers, and it applies to open-source, AI software, and SaaS. Here is what changed, why it was done, and why it lands next to the cryptographic bill of materials we build.
Most post-quantum material is one of two things: a vendor pitch that tells you to panic, or a standard that assumes you already have a doctorate. We built the part in between and put it online for free. The quantakrypto knowledge base is 11 collections, 49 topics, an 85-term glossary, and straight answers, with reading paths for employees, IT, and leadership.
Every post-quantum migration plan starts with the same step, and almost everyone underestimates it: know exactly what cryptography you have. A cryptographic bill of materials (CBOM) is that inventory in a standard, machine-readable form. Here is how to produce one across your code and your infrastructure in about a minute, with qScan, and what to do with it once you have it.
A machine can already ask a site what to crawl (robots.txt) and who to email about a bug (security.txt). It cannot ask what cryptography the site runs or how far along its post-quantum migration is. We are proposing a small well-known file that answers exactly that, and shipping the emitter in qScan. It is a proposal, not a ratified standard.
We added 201 government and public-sector sites to the PQC Observatory and measured them as their own panel. Just under a third negotiate post-quantum key exchange today. The pattern is not the one you would guess: several of the governments writing the migration mandates have not enabled it on their own front doors, while smaller states are already there.
A one-time scan tells you where you stand today. Migration is a moving target, so we now track posture over time: an append-only snapshot per scan, a drift alert when a commit reintroduces quantum-vulnerable crypto, and migration projects that group findings by an identity that survives a line shift.
Point-in-time certificates go stale the day after issuance, and buyers know it. Our attestation keeps the issuance proof but adds a machine that re-verifies the posture against live scans on a schedule; the public status degrades to re-verifying and then lapsed if the evidence drifts, and recovers on its own.
Every scanner treats RSA on a marketing microsite and RSA on 25-year health records as the same finding. Real risk is a property of the data behind the crypto. We now compute an exposure score per finding, vulnerability times data sensitivity times a Mosca margin, and rank the migration backlog by risk instead of by count.
Every month we probe a fixed panel of public hosts for hybrid key exchange and certificate posture, then publish the trend. Here is what the observatory measures, how, and why a vendor-neutral series is worth keeping.
AI coding agents are fluent in cryptography and blind to its expiry date. The quantakrypto MCP gives them the missing sense. Here is the workflow we actually use: what to delegate to the agent, and where a human still decides.
Audits catch exploitable bugs; conformance is a different axis. Here is how to test any ML-KEM / ML-DSA / SLH-DSA implementation against FIPS 203/204/205 in a few minutes, plus a real (since-fixed) FIPS 203 deviation it surfaced in a widely-used library.
Credential theft is the front door to most breaches, and the fix is not a sterner lecture about passwords. It is a system: modern policy grounded in NIST 800-63B, the tooling that makes the policy real, and scanning that catches secrets in code before they ship.
You cannot predict when a quantum computer will break RSA, and Mosca's inequality (X + Y > Z) says you do not need to. Here is the arithmetic that decides whether you should already be migrating.
We built a scanner to inventory quantum-vulnerable cryptography and ran it across 43 popular open-source projects. It flagged the RSA and elliptic-curve keys we expected and, more often than we'd like, TLS certificate verification switched off in production.
We exist for one reason: to get your systems quantum-ready before Q-day. Here's who we are, what the lattice in our mark means, and what you'll find on this blog.
Quantum computing just hit its transistor moment: real systems, real early uses, and a cryptographic reckoning that's a planning problem today and a break-glass problem in the 2030s. The gap between a finished standard and an unstarted migration is why this firm exists.
Why we don't wait for a quantum computer to arrive before we act, and how to decide what to migrate first using a clock you already own.
Four steps from "we should look into this" to a certificate you can hand an auditor: audit, tools, certification, training. Here's how each one works.
You do not need to predict when a cryptographically relevant quantum computer arrives. You need to weigh the cost of migrating too early against the cost of migrating too late, and those costs are not symmetric.
A messaging system issued post-quantum prekeys one-shot but never retired them after use, letting an attacker replay the same ML-KEM encapsulation and quietly defeat forward secrecy.
Hybrid KEMs and hybrid signatures are not the same problem. For key exchange, the industry has largely converged on X25519MLKEM768, and there are good reasons to follow rather than invent.
Even a correct-looking post-quantum implementation can fail in the specific bug-class patterns we see repeatedly in audits. Sieve encodes those classes as targeted, reusable test batteries.
“Add post-quantum” is not a single switch. The first deliverable of a serious migration is a cryptographic inventory: every place asymmetric cryptography is used, and what depends on it. Here is how national cyber agencies build one, and why it is the hard part.
We have audited ML-KEM implementations whose decapsulation leaked secret-dependent timing, the class of side-channel that the 2024 KyberSlash and clangover attacks turned into practical key recovery.
Book a discovery call and get an indicative scope and pricing for your organisation.