In 2022, a post-quantum algorithm that had spent five years in NIST's process was broken in about an hour on a single processor core.
Nobody used a quantum computer. Castryck and Decru found a new classical attack that recovered the key for SIKE's smallest parameter set in roughly 62 minutes. SIKE was a fourth-round candidate at the time.
Rainbow, a NIST finalist for signatures, took a heavy hit the same year. An attack recovered keys for its lowest-security second-round parameters in an average of 53 hours on a laptop, and the same research undermined its wider security claims.
PQR uses ML-KEM to set up its keys. ML-KEM is built on lattices, a different family of maths from SIKE, and NIST currently believes it is secure. No cryptography comes with a permanent guarantee, though, so PQR is designed to stop depending on it: after one exchange nobody could capture, a later break of ML-KEM can't be used to rebuild the keys.
We call the wider principle Contained Cryptographic Failure. PQR keeps evolving its keys and keeps security domains apart, so the damage from a broken algorithm is designed to stay inside the domain it hits. That depends on independent keys, secure erasure of old ones and a correct implementation, and recovery needs fresh secret material the attacker can't reach.
Does your migration plan have a page for that day? https://t.co/VrCku0jou5
A substation, an air traffic system or a nuclear plant can stay in service for decades. Cryptography rarely lasts that long without change.
These operators can't readily take their systems offline every time a standard moves, so the security has to be able to change while the system keeps running.
We've designed QuStream for that across energy grids, aviation, civil nuclear and chemicals, with coordinated hardware, firmware and software that support new cryptographic requirements over a system's working life.
Whoever solves this gets to sit inside some of the longest-lived systems on earth.
21.1 billion connected devices were estimated to be online by the end of 2025. Many of them will never get a new chip.
That's where the commercial model for PQR-ES gets interesting. Compatible devices take a signed firmware update, with no recall, board redesign or extra quantum hardware. The specialised hardware sits in our network and delivers fresh entropy as a service.
Manufacturers get modern security for products they've already shipped. QuStream gets a service relationship that can run for the working life of each device, and many of these devices are expected to run for a decade.
Post-quantum safe. AI resilient. Cryptographic failure contained.
That was on screen in London this week as we presented PQR-C2, our protection for military command and control. If equipment is captured, it's designed to limit what an attacker can read.
https://t.co/U01V9VYCmB
Plenty of tech companies pitch a network they plan to build. Ours is already running.
In October, our dashboard showed 3,717 nodes online (the computers that run the network) across seven regions of the world.
Next, we want it to help smart meters, sensors and other connected devices. They need random numbers to build secure keys. There are billions of them, many struggle to make good random numbers, and many are too cheap or too small to carry special hardware for it.
Our plan is for the network to deliver those numbers safely, with a software update on devices that can take one.
For $QST holders, that's the goal: a network with a real commercial job to do.
The hardest device to secure is the one already installed.
A smart meter can sit on a wall for years with the chip it shipped with. Changing that chip means a visit to every address, and the cost adds up fast.
Our plan for meters already in the field is firmware plus our node service, with no chip swap. New meters can carry the QuStream chip from day one. That way, security can reach both without waiting for a replacement cycle.
Investors don't take a young company's word for its own technology. They want to know what defence players think.
This week, one of Romania's biggest military communications companies sat down with us, and both sides want to make it work.
Full recap: https://t.co/zSCW4IYmPN
Alice & Bob estimate that a quantum computer with about 30,000 physical qubits could break a Bitcoin key in roughly 62 minutes. Google's estimate in March was under 500,000.
The model is theoretical and the two studies assume different hardware. Still, each new estimate has come in lower, and Alice & Bob expect hardware and requirements to meet in the early 2030s.
The same timing problem applies wherever keys last for years. Smart meters, drones and grid controllers stay in service for decades, and replacing their security takes years too.
We designed the Post-Quantum Ratchet so keys keep moving and a single broken key doesn't unlock years of recorded traffic.
See how: https://t.co/VrCku0jWjD
https://t.co/YYL0f0Nkfa
Investors don't take a young company's word for its own technology. They want to know what defence players think.
This week, one of Romania's biggest military communications companies sat down with us, and both sides want to make it work.
Full recap: https://t.co/zSCW4IYmPN
Real networks don’t behave like perfect lab conditions. Radio signals fade. Packets get lost. Remote sensors miss transmissions. Yet communication still needs to continue securely.
QuStream's Post-Quantum Ratchet design addresses this by separating two jobs: deriving the right key for each new packet, and updating the shared security state when both ends confirm they have processed the same traffic.
The result? A lost packet doesn't automatically mean restarting the connection or negotiating new keys. Communication can continue, while the ratchet waits for a clean confirmation before strengthening its state.
The link can lose packets without the devices losing their place in the secure conversation.
PQC upgrades the algorithm for a quantum world.
But the last-mile problem remains.
Every endpoint, device, application and network still has to be migrated, integrated, updated and trusted to handle the new stack correctly.
That is where exposure lives.
What can an attacker capture?
What can they store?
What can they reuse later?
QuStream takes a different route:
- public quantum-random material
- secret endpoint paths
- fresh keys derived locally
- no bulk key material moving across the network
Not just stronger post-quantum maths.
Less valuable exposure at the places real systems actually fail.
Somewhere, a server is filling up with recordings of encrypted traffic.
Nobody can read them yet.
The plan is to wait until the lock that set up those connections breaks, then open everything at once.
Adrian Neal's new paper gives that server a problem:
In our Post-Quantum Ratchet, one batch of random data swapped where nobody could listen gets mixed into every key that follows.
Break the lock in 2045, hold every recorded byte, and those keys still won't rebuild. #EverlastingSecurity
Every encrypted recording made today is a bet that the lock holds forever.
Adrian Neal's paper shows how PQR stops making that bet. After one exchange nobody could capture, a future break of the post-quantum setup lock can't rebuild the keys that follow.
He calls it everlasting security ➡️ https://t.co/zzKkxmwyng
Assume a device gets captured one day. What can the attacker read?
That depends on how its keys were built.
A drone goes down behind the line. If its radio shares one long-lived key with the rest of the fleet, whoever recovers it may be able to read every radio on that key, including traffic recorded months earlier.
Grid equipment stays in service for decades. Take a controller from an unmanned substation, and a key that never changes can open years of recorded control traffic.
Smart meters ship by the batch. If a batch shares one key baked into firmware, a single meter opened on a workbench can be enough to read the rest.
A seized satellite ground terminal is the same story, on a link that may need to stay secure for as long as the satellite flies.
PQR is designed to keep the answer short. Keys keep evolving and old ones are erased, so a captured device exposes only the messages under its current key. Systems with independent keys in separate security domains stay outside the breach. How long that window lasts is a setting. Once fresh secret material arrives that the attacker can't reach, protection recovers.