QuantumLock, the post-quantum SDK and API from SoftQuantus
QuantumLock gives software teams post-quantum cryptography through a REST API and a Python SDK: ML-DSA signatures alone or next to a classical one, licences that validate under post-quantum rules, and an inventory of the cryptography that still has to move.
ML-DSA follows FIPS 204 and comes from liboqs. QuantumLock is not CAVP-validated, and it says so on every page.
- Signatures
- ML-DSA (FIPS 204)
- Transition
- Hybrid, both must verify
- Stage
- In production
| Capability | How you use it | Stage |
|---|---|---|
| Post-quantum signing | Sign a digest with ML-DSA through the REST API | In production |
| Hybrid signing | Sign with a classical and an ML-DSA key; accepted only when both signatures verify | In production |
| Post-quantum licensing | Validate software licences under classical and post-quantum rules | In production |
| Cryptographic inventory | Import a CycloneDX 1.6 CBOM and evaluate it against a versioned policy pack | In production |
| QuantumLock MCP server | Let AI agents sign and evaluate inventories | In development |
ML-DSA in QuantumLock comes from liboqs and is not CAVP-validated. QuantumLock signs and verifies; it does not offer key exchange or encryption.
Install
The Python packages
The quantumlock and quantumlock-sdk packages validate licences from Python. Signing, hybrid signing and inventory are REST calls to quantumlock.softquantus.com with an API key in the X-API-Key header, listed on the API page.
pip install quantumlock quantumlock-sdkWhere to start
Start from the problem in front of you
Sign for the long term
ML-DSA signatures, alone or alongside a classical signature, from one API.
Quantum-safe signaturesFind vulnerable cryptography
Turn a CBOM into a pass, review or fail decision with a reproducible id.
Cryptographic inventoryPlan the migration
Regulators have put dates on RSA and ECC. See the timeline and the first steps.
Post-quantum cryptographyQuestions
Post-quantum SDK questions
What is a post-quantum SDK?
A software development kit that gives an application cryptography designed to resist attacks by quantum computers, such as the ML-DSA signature standard in FIPS 204, without the team implementing the algorithms itself.
Which post-quantum SDK does SoftQuantus offer?
QuantumLock. It provides ML-DSA signing, hybrid classical and post-quantum signing, post-quantum licensing and cryptographic inventory through a REST API and Python packages on PyPI.
Is QuantumLock validated?
No. ML-DSA in QuantumLock comes from liboqs and is not CAVP-validated. QuantumLock states this wherever it describes its cryptography.
Does QuantumLock encrypt data or exchange keys?
No. QuantumLock signs, verifies, licenses and evaluates inventories. It does not offer encryption or key exchange.
How does QuantumLock relate to QCOS?
QCOS is the SoftQuantus quantum operating system. QuantumLock is its post-quantum trust layer and a separate product with its own licence. See quantum operating system.
Read next
More about post-quantum security
Sign one artifact with us
Bring a release or a firmware image to a demo and leave with a hybrid signature and a verification you can repeat.