Capabilities Post-quantum cryptography
Capability · Post-quantum cryptography
Ready for the post-quantum era, starting now.
Data recorded today can be decrypted once a large enough quantum computer exists, and signatures made today can be forged. ApexAI already signs its own critical records with post-quantum algorithms, and helps you find and replace the cryptography in your systems that will not survive that change.
Status: Available Post-quantum signing in the platform and CBOM scanning with migration designs are available; post-quantum field protection is in preview, and hybrid post-quantum transport on tunnels and the gateway is on the roadmap.
Why act before the quantum computer arrives
Today’s public-key cryptography, such as RSA and elliptic curves, rests on problems a large quantum computer is expected to solve. Nobody can say exactly when that will happen, but the risk starts earlier. An attacker can record encrypted traffic and stored data now and decrypt it later, an approach known as harvest now, decrypt later. Anything that must stay confidential or authentic for years is already exposed.
The answer has been standardised. In 2024 NIST published ML-KEM for key establishment [1] and ML-DSA for digital signatures [2]. The hard part is the migration: knowing where vulnerable cryptography lives in your code and systems, deciding what to change first, and moving without breaking what works.
Post-quantum in ApexAI today
Signed licences
Platform licences are signed with ML-DSA, so they cannot be forged with today’s or tomorrow’s computers.
Hybrid-signed audit trail
Audit entries are signed with both a classical and a post-quantum signature, so the record stays verifiable as the cryptography changes.
Signed decision policies
The SOC’s decision policies are signed with ML-DSA and bound to their workspace, so a changed policy is detectable.
Standard algorithms
ApexAI uses the NIST-standardised ML-KEM and ML-DSA with their standard parameter sets, not home-grown cryptography.
Your migration, step by step
PQC Shield, part of the ApexAI platform, turns post-quantum migration into a tracked piece of work.
01
Assess
Scan your repositories and build a cryptography bill of materials (CBOM) in the CycloneDX format.
02
Prioritise
Classify each finding by its exposure to harvest now, decrypt later, so long-lived data comes first.
03
Design
Get a migration design for each finding toward ML-KEM and ML-DSA.
04
Remediate
Track every finding until it is fixed. Changes are work for your team, never an automatic configuration change.
05
Report
Export reports for engineering, risk and auditors.
What is available and what is next
| Area | What it covers | Status |
|---|---|---|
| Platform signing | Licences, audit trail and decision policies signed with ML-DSA (audit trail hybrid with a classical signature) | Available |
| CBOM and migration | CycloneDX CBOM scanning, risk per finding, migration designs, remediation tracking, reports | Available |
| Field protection | Post-quantum envelope for long-lived sensitive fields with ApexAI Data Gate | Preview |
| Post-quantum transport | Hybrid post-quantum key exchange on tunnels and on ApexAI Causeway | Roadmap |
| Signed gateway configuration | Post-quantum signed configuration for gateways at your site | Roadmap |
Questions
What are ML-KEM and ML-DSA?
They are the post-quantum standards NIST published in 2024: ML-KEM (FIPS 203) for agreeing on encryption keys and ML-DSA (FIPS 204) for digital signatures. Both are designed to resist attacks by quantum computers.
What is a CBOM?
A cryptography bill of materials: an inventory of the algorithms, keys and libraries your software uses. It is the starting point of any post-quantum migration, because you cannot replace what you cannot find.
Will ApexAI change our cryptography automatically?
No. Findings and migration designs become work for your team to review and carry out. Nothing in your systems is reconfigured by ApexAI.
What does hybrid mean in post-quantum cryptography?
Hybrid means combining a classical algorithm with a post-quantum one, so protection holds as long as either of them remains unbroken. It is the usual way to adopt post-quantum cryptography safely during the transition.
Sources
Third-party figures, as published by their sources.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.