Quantum-Resilient Infrastructure: SoftIron's Proactive Approach to Cryptographic Security

Quantum-Resistant Cryptographic Arsenal

We don't just talk about post-quantum security—we've engineered it into the core of our solutions. Our advanced cryptographic extension supports a comprehensive suite of quantum-resistant algorithms, carefully selected to meet emerging FIPS standards.

Key Encapsulation Mechanisms (KEM)

Kyber (DRAFT FIPS 203): A lattice-based key exchange mechanism designed to resist quantum computational attacks
ML-KEM (FIPS 203 Final): The standardized version of Kyber, providing robust key encapsulation

Digital Signature Algorithms

Dilithium (DRAFT FIPS 204): A high-performance, quantum-resistant digital signature algorithm
ML-DSA (FIPS 204 Final): The standardized signature algorithm ensuring long-term cryptographic integrity
SPHINCS+ (DRAFT FIPS 205): A hash-based signature scheme providing additional cryptographic resilience

Data-in-transit: TLS

We've added support for post-quantum cryptography (PQC) to secure data-in-transit across our platforms. This includes TLS endpoints for the web interface, APIs, metadata, and S3 object storage.

Our solutions support modern hybrid key exchanges (such as X25519+ML-KEM 768 and NIST P-Curve+ML-KEM 768) for compatibility with existing clients, pure PQC key exchanges (ML-KEM 1024 and ML-KEM 768) that meet FIPS 203 standards, and traditional encryption methods like ECC (X25519 and NIST P-Curve) for legacy fallback.

This ensures robust security for both current and future cryptographic needs.

Data-in-transit: SSH

We've enhanced our SSH endpoints with support for post-quantum key exchange, ensuring stronger protection against future threats while maintaining compatibility with current systems. This includes the hybrid key exchange algorithm ML-KEM 768 + X25519 + SHA-256, which combines the resilience of post-quantum cryptography with proven traditional methods for advanced security.

By leveraging hybrid key exchanges, our solution ensures secure communication even as cryptographic standards evolve. For legacy systems or clients that do not yet support PQC, we provide traditional SSH key exchange algorithms as a fallback. This approach allows for a smooth transition to post-quantum readiness while minimizing disruptions.

Data-at-rest, assured

We generate a 512-bit AES-XTS key by combining 256 bits of RSA-encrypted data and 256 bits of AES-CTR encrypted data, with the AES-CTR key derived from an ML-KEM encoded secret. This process ensures that private keys are securely stored on a smartcard, protecting them from exposure.

Dual-Solution Quantum Preparedness

HyperCloud
Comprehensive Quantum-Safe Infrastructure

A fully integrated hardware and software solution that provides end-to-end protection. HyperCloud doesn't just support post-quantum cryptography—it makes it a fundamental feature of your cloud infrastructure.

VM Squared
Flexible Quantum-Resistant Virtualization

Our hypervisor solution brings quantum-safe cryptographic modules to commodity hardware, allowing organizations to upgrade their existing infrastructure without complete system replacement.

Beyond compliance

SoftIron is taking a proactive security approach. Our cryptographic extension is more than a checklist of features. It represents our commitment to:

Anticipating future computational threats
Providing seamless, standards-compliant security
Offering flexibility across different infrastructure configurations

We're not just preparing for the quantum era—we're helping you build a resilient, future-proof digital ecosystem.

Read our blog post to learn more.