Inventory only
Web, VPN and SSH
Key exchange on these protocols is moving to hybrid. QuantumLock does not do TLS or key establishment; its inventory flags where a protocol still uses classical key exchange alone.
QuantumLock™
Post-quantum signing for
what has to stay trusted.
QuantumLock signs software, firmware and licences with ML-DSA, finds quantum-vulnerable cryptography in your inventory, and works with the KMS or HSM you already run.
ML-DSA is the NIST FIPS 204 algorithm, run here through liboqs, not CAVP-validated. QuantumLock holds no certification.
- ML-DSA-65 signature size
- 3,309 B
- Bring-your-own key options
- 4
- Built-in policy packs
- 6
Counted from the code and the demo run, not performance claims.
The Problem: Today’s Signature Has to Stay Good for Years
No public quantum computer can do this today. The reason to act early is how long the things signed and recorded now stay in use.
Harvest now, decrypt later
The risk to data that has to stay secret.
Step 1
Capture
Encrypted traffic is recorded today.
Step 2
Store
It is kept. Nothing looks wrong.
Step 3
Quantum computer
A cryptographically relevant machine arrives.
Step 4
Break
Shor’s algorithm recovers the key exchange secret.
Step 5
Read
The recorded data can be read.
The fix here is key exchange. QuantumLock does not provide key establishment or TLS; its inventory shows where classical key exchange remains.
Trust now, forge later
The risk to anything that has to stay trusted.
Step 1
Sign
Firmware ships with an RSA or ECC signature.
Step 2
Deploy
The device trusts that public key for years.
Step 3
Quantum computer
A cryptographically relevant machine arrives.
Step 4
Derive key
The private key is derived from the public key.
Step 5
Forge
An attacker signs their own update and it verifies.
QuantumLock works at step 1: sign with ML-DSA (liboqs, not CAVP-validated), or hybrid during the move, accepted only when both verify.
Post-Quantum Cryptography, and Where QuantumLock Sits in It
Part 1
The Problem
RSA and ECC
Factoring and the discrete logarithm carry today’s signatures and key exchange.
Shor’s Algorithm
On a large enough quantum computer, it solves both.
Part 2
The Replacement
Post-quantum cryptography
Classical algorithms built on problems with no known efficient quantum attack, run on today’s machines.
Part 3
NIST Standards
ML-KEM
FIPS 203
Key establishment
In QuantumLock: key generation only.
ML-DSA
FIPS 204
Signatures
In QuantumLock: signing in production, liboqs, not CAVP-validated.
SLH-DSA
FIPS 205
Hash-based signatures
In QuantumLock: key generation only.
Part 4
In QuantumLock
Know
Read a CBOM and evaluate it against policy packs.
Protect
ML-DSA signing (liboqs, not CAVP-validated), hybrid signing and licence tokens.
Verify
quantumlock verify answers VALID or INVALID from the artefact and its signature file.
Know what you run, sign what has to last, and verify before you trust it.
Watch It Run
Three recordings of real output on sample inputs. Nothing on screen is a mock-up, and none of it comes from a customer system.
Use Cases
Where the Post-Quantum Move Applies
These are the systems the migration reaches, not customers or deployments. Each card says what QuantumLock does there and what it does not. Footage is illustrative.
Internet and Communications
Inventory only
Telecom Networks
A CBOM records where classical cryptography sits across a network. Migrating radio and core stays with the vendors.
Finance and Government
Signing + inventory
Banking and Payments
Evaluate a CBOM of payment systems against policy packs, and sign the software that runs on them.
Signing
Contracts and Digital Identity
Hybrid signing keeps a classical signature and ML-DSA (liboqs, not CAVP-validated) together, accepted only when both verify. QuantumLock is not a qualified e-signature service or a certificate authority.
Signing + inventory
Government and Defence
Inventory cryptography and sign long-lived software. QuantumLock holds no government accreditation.
Cloud and Devices
Signing
Cloud Workloads
Bring your own keys via AWS KMS, Google Cloud KMS, Azure Key Vault or a PKCS#11 HSM. The classical half stays in your KMS; the ML-DSA half (liboqs, not CAVP-validated) is signed by the QuantumLock local provider.
Signing
Firmware and Software Updates
Sign a release and verify it before install. One flipped byte fails, as the film above shows.
Signing
Connected Vehicles
A vehicle can outlive the algorithm that signed its first firmware. Release signing is the part QuantumLock covers.
Signing
Medical Devices
Sign device software releases. QuantumLock is not medical device software and has no regulatory clearance.
Signing + inventory
Energy Grids
Sign controller firmware and inventory the cryptography in substations and control systems.
How It Works
Keys, Signatures and Inventory
AWS KMSGoogle Cloud KMSAzure Key VaultPKCS#11 HSM
Classical half, in your custodyBring Your Own Keys
- The classical half of a hybrid signature stays in your KMS or HSM.
- The ML-DSA half is signed by the QuantumLock local provider, not by your cloud KMS.
- A post-quantum key that is not ML-DSA is refused, so a classical key cannot pass as the post-quantum half.
ClassicalML-DSA
Both must verifyHybrid Signing
- A hybrid signature is accepted only when both halves verify.
- In the demo film: ECDSA P-384 plus ML-DSA-65. Flipping either half fails.
- ML-DSA runs through liboqs, not CAVP-validated.
CycloneDX CBOMSix built-in policy packsVerdict and findings
Cryptographic Inventory
- Reads a CycloneDX CBOM and lists the algorithms, certificates and protocols it describes.
- Evaluates it against built-in packs: a QuantumLock baseline, the themes of the NIST IR 8547 draft, the EU NIS Cooperation Group roadmap, BSI and ANSSI.
- A pack result is an evaluation, not a compliance claim.
Not in QuantumLock Today
Listed so nobody buys it for something it does not do.
Capabilities
- No key establishment and no TLS.
- ML-KEM and SLH-DSA are key generation only.
- No encryption API. The Cipher API is retired.
- No hybrid X.509 certificate authority.
- No FIPS or CAVP validation. ML-DSA runs through liboqs, not CAVP-validated.
- A pack evaluation is not compliance. Regional packs evaluate themes and do not encode dates.
- The ML-DSA half of a hybrid signature is not held in your cloud KMS.
- No government accreditation, no medical clearance and no qualified e-signature.
Standards and Approvals
QuantumLock holds no SOC 2, ISO 27001, FIPS 140-3 or Common Criteria certification. It has had no third-party penetration test, and it carries no SLA.
ML-DSA signing covers customer artefacts and licences. QCOS evidence bundles are a separate thing: they are sealed under a SHA-256 Merkle root and verified offline, not signed.
Stay Informed
Product updates on QuantumLock.
Start with one release and one inventory.
Bring a firmware image and a CBOM. We sign the first, evaluate the second, and show you every finding.