Post-quantum posture
Shor breaks keys. Grover only dents hashes.
An evidence chain is not a secret — it is a commitment. That distinction decides which of this platform's primitives a quantum computer would actually threaten, and this page walks each one, then recomputes the evidence root three ways in your own browser.
Live lab · runs entirely on your device
One evidence set. Three digest families. Two tree shapes.
Algorithm checklist
The standardised algorithms, their parameter sizes, and where each one sits here
| Algorithm | Standard | Purpose | Level | Public key | Secret key | Output | Status |
|---|---|---|---|---|---|---|---|
| ML-KEM-768CRYSTALS-Kyber | FIPS 203 (2024) | Key establishment | NIST category 3 | 1 184 B | 2 400 B | 1 088 B ciphertext · 32 B shared secret | adopted |
| ML-KEM-1024Kyber-1024 | FIPS 203 | Key establishment | NIST category 5 | 1 568 B | 3 168 B | 1 568 B ciphertext | planned |
| ML-DSA-65CRYSTALS-Dilithium3 | FIPS 204 (2024) | Digital signature | NIST category 3 | 1 952 B | 4 032 B | 3 309 B signature | planned |
| SLH-DSA-SHA2-128sSPHINCS+ | FIPS 205 (2024) | Digital signature | 128-bit classical | 32 B | 64 B | 7 856 B signature | evaluating |
| FN-DSA (Falcon-512)Falcon | FIPS 206 (draft) | Digital signature | NIST category 1 | 897 B | 1 281 B | 666 B signature | evaluating |
| AES-256-GCMRijndael | FIPS 197 / SP 800-38D | Symmetric | 256-bit classical · ~128-bit post-Grover | — | 32 B | 16 B authentication tag | adopted |
| SHA-384 / SHA-512SHA-2 family | FIPS 180-4 | Hash | 192 / 256-bit collision · halved preimage under Grover | — | — | 48 B / 64 B digest | adopted |
| RSA-2048 / ECDSA P-256Classical public key | FIPS 186-5 | Digital signature | 112 / 128-bit classical · broken by Shor | 256 B / 64 B | — | 256 B / 64 B signature | not applicable |
A-01 · ML-KEM-768
Used inside hybrid TLS as X25519MLKEM768, so a session needs both the lattice and the elliptic-curve half to be broken.
A-02 · ML-KEM-1024
Reserved for long-lived archive transfers, where a decade of harvest-now-decrypt-later exposure is the realistic threat.
A-03 · ML-DSA-65
Target for signing attestation bundles when a signature is added. Today bundles carry no signature at all, so nothing can be forged.
A-04 · SLH-DSA-SHA2-128s
Hash-based, so its security rests on SHA-2 rather than a lattice assumption — the conservative fallback if lattice cryptanalysis advances.
A-05 · FN-DSA (Falcon-512)
Smallest post-quantum signature; held back until the standard is final and constant-time implementations are widely audited.
A-06 · AES-256-GCM
Grover halves effective key strength, so AES-256 lands where AES-128 sits classically. No migration needed.
A-07 · SHA-384 / SHA-512
Every evidence root is published under SHA-256, SHA-384 and SHA-512 from one preimage, so raising the floor is a selection rather than a re-chain.
A-08 · RSA-2048 / ECDSA P-256
Never load-bearing for evidence integrity here. Where certificates use it, exposure is bounded by short certificate and session lifetimes.
Threat timeline
What is already true, what is mandated, and what is only an estimate
2024
observedThe standards landed
NIST published FIPS 203, 204 and 205, making ML-KEM, ML-DSA and SLH-DSA usable in procurement language rather than research papers.
2025 – 2026
observedHybrid key agreement becomes the default
Major browsers and edge networks ship X25519MLKEM768 on by default, so most traffic gets post-quantum key establishment without any application change.
By 2030
mandatedDeprecation of classical public key begins
NIST IR 8547 sets 2030 for deprecating RSA-2048 and ECC P-256 in new systems, with full disallowance by 2035. Inventory and migration plans are expected well before that.
By 2035
mandatedGovernment migration deadline
US NSM-10 and the EU coordinated roadmap both target 2035 for high-value systems to complete migration; regulated sectors will be asked for evidence sooner.
2030s (uncertain)
projectedA cryptographically relevant quantum computer
Expert surveys put a machine able to break RSA-2048 somewhere in the 2030s with wide disagreement. Anyone quoting a precise year is selling something.
Retroactive
observedHarvest now, decrypt later
Encrypted traffic recorded today can be opened whenever that machine arrives. The deadline for confidentiality is therefore already past; integrity commitments do not share this problem.
Dated mandates are quoted from published policy; capability dates are expert estimates and are labelled as such. Nothing on this page claims to know when a cryptographically relevant quantum computer arrives.
Upgrade path
How to migrate — the eight steps, and which are already done here
U-01 · complete
Inventory every cryptographic dependency
List each primitive by what it protects, how long that protection must hold, and whether Shor or Grover applies. Confidentiality with a long shelf life migrates first.
The primitive register below is that inventory, published rather than filed.
U-02 · complete
Separate commitments from secrets
Integrity commitments only need collision resistance and survive quantum attack; secrets need key agreement and do not. Sorting them stops one migration from blocking the other.
Attestation bundles are hash-only, so verification never touches a quantum-breakable key.
U-03 · complete
Turn on hybrid key agreement
Serve TLS with X25519MLKEM768 so a recorded session needs both halves broken. This is an edge configuration, not an application rewrite.
Negotiated wherever the visiting browser offers it; the classical half remains the floor.
U-04 · complete
Publish roots under several digest families at once
Commit the same preimage under SHA-256, SHA-384 and SHA-512 so raising the hash floor later is a choice of column, not a re-chain of history.
The live lab above recomputes all three, linear and Merkle, in your own browser.
U-05 · complete
Bound the lifetime of anything signed classically
Keep session tokens and certificates short-lived with server-side revocation, so a key broken in a future decade cannot forge a credential that already expired.
Portal sessions are minutes-to-hours with revocation on the server.
U-06 · complete
Make crypto choices swappable
Reference algorithms through one module so a parameter change is a single edit, and record the algorithm used inside every artefact it produces.
Digest family is named in each published root, so a reader never has to guess.
U-07 · planned
Add ML-DSA signatures over bundles
When downstream systems require a signature rather than a recomputable root, sign with ML-DSA-65 and keep the hash root as the primary check.
Planned. Not yet implemented — bundles are hash-only today, and that is stated as such.
U-08 · planned
Re-test and re-attest on a schedule
Re-run the root computation, confirm negotiated key exchange, and re-check the inventory whenever a standard or parameter set changes.
Ongoing. The lab makes the check reproducible by anyone, not just by us.
Primitive register
Which primitive does what, and what a quantum adversary does to it
Evidence chain and attestation roots
SHA-256 → SHA-384/512 hash chain
weakenedGrover's algorithm reduces a preimage search from 2^256 to roughly 2^128 operations — still far beyond any projected machine. Collision resistance, which is what a tamper-evident chain relies on, is barely affected.
Roots are published under SHA-256, SHA-384 and SHA-512 from the same preimage, so a future migration is a selection, not a rebuild.
Transport of every page and API response
TLS 1.3 key agreement (X25519)
brokenShor's algorithm breaks elliptic-curve key agreement outright. Traffic recorded today could be decrypted retroactively once a capable machine exists — the harvest-now, decrypt-later problem.
Served over hybrid X25519MLKEM768 wherever the edge and the browser both offer it: a classical and a lattice key exchange combined, so the session survives either one failing.
Session authentication for the client portal
Signed session tokens (ECDSA/HMAC)
weakenedSignature keys are Shor-vulnerable, but session lifetimes are minutes to hours. A key broken in a future decade cannot forge a token that already expired.
Short-lived tokens plus server-side revocation keep the exposure window bounded independently of the signature algorithm.
Evidence at rest in the private store
AES-256-GCM
unaffectedGrover halves the effective key strength of a symmetric cipher, leaving AES-256 at roughly 128 bits — the level AES-128 provides classically, and the level standards bodies still consider sound.
No migration required. AES-256 was already chosen over AES-128 for this reason.
Downloadable attestation bundles
Hash-only, no signature
unaffectedA bundle carries no signature to forge: it is re-verified by recomputing the root from the digests and outcomes it contains, in the reader's own browser.
Verification needs no key, no certificate and no trusted third party — so there is nothing quantum-vulnerable in the verification path.
Randomness in simulation and audit sampling
Deterministic seeded PRNG
unaffectedSimulation randomness is deliberately reproducible so a reviewer can re-run a scenario and get the identical chain head. It is not used as a secret.
Secrecy never depends on this generator; anything security-bearing uses the platform CSPRNG.
Hybrid key agreement depends on what the serving edge and the visiting browser both support, so it is a deployment posture rather than a guarantee. No cryptographic choice makes a system impossible to breach — see the trust and audit register for what is claimed and what is not.
Reasoning architecture
Five layers between a model's confidence and a real-world action
L1
Bounded authority
Every model output is issued at an authority level fixed before the model runs. Certainty can narrow what an employee may do; it can never widen it.
L2
Adversarial self-check
Each material recommendation is re-argued against itself: the strongest case for refusing is generated before the case for acting is accepted.
L3
Evidence linkage
A conclusion without a linked artefact is treated as unsupported and downgraded, no matter how confident the model reports itself to be.
L4
Deterministic gates
Credentials, cancellation state and financial completeness are checked by code, not by inference. A gate failure ends the path.
L5
Reconstructable record
Model identity, policy version, inputs, confidence and outcome are recorded so any decision can be replayed months later.
The same architecture is visible working in the operations console and re-verifiable in the attestation studio.