标签：#quantum

Published 2026-09-06 This describes NIST IR 8547 ipd — the initial public draft of November 2024 — as it stood on the date above. Its dates are proposed. If a final IR 8547 has published since you are reading this, check it: the numbers below may have moved, and the article's central caveat may no longer apply. If you have read anything about post-quantum migration in the last year, you have read that RSA is deprecated in 2030. It is one of those facts that has been repeated into the shape of a rule. It is half true, and the half that is false is the half people plan around. Here is the actual table, from NIST IR 8547, Transition to Post-Quantum Cryptography Standards : algorithm parameters transition RSA, ECDSA 112 bits of security strength Deprecated after 2030 Disallowed after 2035 RSA, ECDSA, EdDSA ≥ 128 bits of security strength Disallowed after 2035 Read the second row again. At 128 bits and above there is no 2030 row at all . RSA-3072 is not deprecated in 2030. Neither is P-256. The 2030 date applies to 112-bit strength — RSA-2048, P-224, 2048-bit finite-field Diffie-Hellman — and to nothing else. The key-establishment table (Table 4, covering finite-field DH/MQV, elliptic curve DH/MQV and RSA) has exactly the same shape. Same split, same dates. So an inventory that reports "47 uses of RSA, all deprecated in 2030" is reporting something the document does not say. Some of those uses are on a 2030 clock and some are on a 2035 clock, and which is which depends on a field most tooling does not look at. Deprecated is not disallowed The second thing worth getting right is what the two words mean, because they are not synonyms and NIST defines both: deprecated — "The algorithm and key length may be used, but the user must accept some security risk." disallowed — "The algorithm or key length is no longer allowed for applying cryptographic protection." Deprecated is a risk acceptance. You may continue, with your eyes open and presumably a note in a register somewhere.

Common sense is of no help in studying reality at the atomic scale.

An argument about a digital file is almost never lost over what the file says. It is lost one question earlier: How do we know that is the file you received, and not the one you edited last night? If the answer is "trust me", you have already lost. However right you are on the substance. This problem is not exclusive to a courtroom. The auditor receiving a log dump has it. So does the team documenting an incident, or anyone keeping a copy of a contract signed over email. In every case the need is the same: being able to prove that a set of bytes has not changed since a given moment — and having that proved by someone who is not you . That is why I wrote Tunjo : a Rust tool that walks material read-only, computes its fingerprint, and signs a record anyone can verify. Why a tree and not a hash The obvious approach would be to concatenate everything and take one SHA-256. It works, and it is useless in practice. When someone disputes one file — a specific email out of four thousand — a single hash leaves you two options: hand over the complete set so it can be recomputed, or ask to be believed. The first exposes material that has no business being exposed; the second is not evidence. A Merkle tree solves exactly that. Each file is a leaf, each pair of nodes combines upward, and a root remains. To prove a leaf belongs to that root, you only need to show that leaf and the path of hashes to the top: a few kilobytes. The rest of the set is never touched. Two details of the tree that are not optional: // Domain separation: a leaf can never pass itself off as an internal node. h .update ([ 0x00 ]); // leaf h .update ([ 0x01 ]); // internal node // And the root binds the number of leaves. h .update ([ 0x02 ]); h .update ( n .to_be_bytes ()); Without the first, a leaf hash could be presented as if it were a node of the tree. Without the second you get the classic ambiguity of trees with an odd number of leaves: two different sets can produce the same root. It is an old, well-kn

When a new cryptographic algorithm appears, a tension shows up: classical algorithms such as X25519 or Ed25519 have resisted attacks for years, but are vulnerable to a future quantum computer; post-quantum ones such as ML-KEM or ML-DSA resist quantum attacks, but are newer and less tested. Hybrid encryption resolves the tension: use both at once . The idea in one sentence Combine a classical and a post-quantum algorithm so that the system only breaks if both fail simultaneously . A classical attacker would have to break the post-quantum algorithm; a quantum attacker would have to break the classical one and the post-quantum one. You gain security against the future without betting everything on a young algorithm. Two places to apply it Key exchange (encrypting for a recipient). You combine: X25519 — classical key exchange, fast and heavily tested. ML-KEM-1024 — NIST's post-quantum key encapsulation mechanism, at its highest level. The two resulting keys are mixed with a context-bound derivation function (HKDF), so that neither one alone is enough. Digital signatures (authenticity). You combine: Ed25519 — classical signature. ML-DSA-87 — NIST post-quantum signature. The message is accepted only if both signatures verify — an AND combiner. One principle that never breaks There is a golden rule in cryptography, Kerckhoffs's principle : a system must be secure even if the attacker knows its entire design; security lives in the key , not in hiding the format. A good hybrid system uses public, audited primitives — XChaCha20-Poly1305 to encrypt, Argon2id to derive keys from passwords, HKDF to separate domains — and never invents its own cryptography . How Quipu applies it Quipu is a free library implementing exactly this approach for data at rest : hybrid X25519 + ML-KEM-1024 encryption, hybrid Ed25519 + ML-DSA-87 signatures, and only verified primitives underneath. It targets NIST security level 5 (CNSA 2.0) and is open source, so anyone can review how it works. An honest

Protecting data that must stay secret ten years from now is a problem for today : an adversary can capture your encrypted traffic now and decrypt it once quantum capability exists ( harvest now, decrypt later ). Quipu is a free hybrid post-quantum encryption library for data at rest: it combines proven classical cryptography with the new kind, so that it only breaks if both fall at once. Pure Rust, and why Quipu started out aiming at several languages: a Rust core with a C ABI on top and bindings for Python, Node and Go. It worked, but the lesson was clear: maintaining a stable C interface plus four bindings, each with its own packaging and interoperability tests, was complexity that did not pay for itself against the real goal — protecting data at rest — and it widened the attack surface with unsafe we did not want. Today Quipu is pure Rust : memory safe, no garbage collector, no first-party unsafe . And for people who do not write Rust, it ships as a native Python wheel via PyO3 — the surface that non-Rust users actually need. One codebase, one thing to audit. It is the same philosophy that guides the rest: where good cryptography exists, reuse it; simplicity is a security decision, not a convenience. Installation cargo add quipu # Rust pip install quipu-crypto # Python (native wheel, PyO3) Encrypt and decrypt in Python import quipu # Symmetric, with a passphrase blob = quipu . encrypt_stream ( b " sensitive data " , " my-passphrase " ) assert quipu . decrypt_stream ( blob , " my-passphrase " ) == b " sensitive data " # Post-quantum, for a recipient pub , sec = quipu . generate_keypair () # X25519 + ML-KEM-1024 c = quipu . encode_to_recipient ( b " secret " , pub ) assert quipu . decode_as_recipient ( c , sec ) == b " secret " What is underneath Encryption: XChaCha20-Poly1305 (authenticated AEAD). Key derivation: Argon2id (brute-force resistant) + HKDF. Post-quantum: X25519 + ML-KEM-1024 for keys; Ed25519 + ML-DSA-87 for signatures. Security level: NIST category 5

There are four patterns that bring PQC into a Spring Boot fleet: encrypting payloads between services, locking down database fields, signing documents that need to hold up for decades, and moving service tokens off RS256. Along the way, we discuss why Harvest Now, Decrypt Later is already happening, and why none of this is production-safe until KMS or Vault is in place. By Pankaj Sharma

The Trusted Computing Group has established a new set of requirements to help organizations determine if Trusted Platform Modules are prepared for the era of post-quantum cryptography. This guidance provides a technical benchmark for evaluating whether hardware vendors can protect electronic devices against the future threat of quantum-enabled cyber attacks. Establishing the Post-Quantum Baseline The newly released guidance provides a framework for businesses to verify the security claims made by hardware manufacturers. By creating a standardized set of requirements, the organization ensures that companies can demand proof of protection. This prevents a situation where vendors might claim their products are compliant without offering the full suite of necessary security features. A primary focus of this initiative is the PC Client Platform TPM Profile 1.07. This profile serves as the minimum technical requirement for any module to be considered ready for the next generation of cryptographic challenges. It builds upon the existing TPM 2.0 Library Specification Version 1.85 to include specific elements for quantum-safe protection. Organizations must understand that security in the quantum age involves more than just swapping out one mathematical algorithm for another. True resilience requires a comprehensive approach to hardware-anchored trust. This includes maintaining the integrity of platform identities and attestation over very long periods. Data and identities established today may need to remain secure for several decades. If the underlying hardware is not built to withstand quantum decryption methods, that long-term security is at risk. Current statistics indicate that a vast majority of businesses still lack a formal roadmap for this transition. The Trusted Computing Group president, Joe Pennisi, emphasizes that businesses must look at the broader picture of security. Individual algorithm support is only one piece of the puzzle. Real security comes from a hard

Proteger datos que deben seguir siendo secretos dentro de diez años es un problema de hoy : un adversario puede capturar tu tráfico cifrado ahora y descifrarlo cuando exista la capacidad cuántica ( harvest now, decrypt later ). Quipu es una librería libre de cifrado híbrido post-cuántico para datos en reposo: combina criptografía clásica probada con la nueva, de modo que solo se rompe si ambas caen a la vez. Rust puro, y por qué Quipu nació apuntando a varios lenguajes: un núcleo en Rust con una C ABI encima y bindings para Python, Node y Go. Funcionaba, pero la lección fue clara: mantener una interfaz de C estable más cuatro bindings, cada uno con su empaquetado y sus pruebas de interoperabilidad, era complejidad que no pagaba para el objetivo real —proteger datos en reposo— y ampliaba la superficie de ataque con unsafe que no queríamos. Hoy Quipu es Rust puro : memoria segura, sin garbage collector , sin unsafe de primera parte . Y para quien no programa en Rust, se distribuye como rueda nativa de Python (vía PyO3) — que es la superficie que el cliente que no es de Rust de verdad necesita. Una sola base de código, una sola cosa que auditar. Es la misma filosofía que guía el resto: donde hay buena criptografía, se reutiliza; la simplicidad es una decisión de seguridad, no una comodidad. Instalación cargo add quipu # Rust pip install quipu-crypto # Python (rueda nativa, PyO3) Cifrar y descifrar en Python import quipu # Simétrico con contraseña blob = quipu . encrypt_stream ( b " datos sensibles " , " mi-passphrase " ) assert quipu . decrypt_stream ( blob , " mi-passphrase " ) == b " datos sensibles " # Post-cuántico para un destinatario pub , sec = quipu . generate_keypair () # X25519 + ML-KEM-1024 c = quipu . encode_to_recipient ( b " secreto " , pub ) assert quipu . decode_as_recipient ( c , sec ) == b " secreto " Qué hay debajo Cifrado: XChaCha20-Poly1305 (AEAD autenticado). Derivación de claves: Argon2id (resistente a fuerza bruta) + HKDF. Post-cuántico: X25519

InfoQ editorial staff and friends of InfoQ are discussing the current trends in the domain of Cloud and DevOps as part of the process of creating our annual 2026 trends report. By Steef-Jan Wiggers, Matt Saunders, Shweta Vohra, Daniel Bryant, Mark Silvester

This is good : Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency , we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.

Zulfi Alam thinks his team doesn’t need to “prove” they engineered a new state of matter in their bid to reinvent computing. Science would disagree.

Una discusión sobre un archivo digital casi nunca se pierde por lo que el archivo dice. Se pierde una pregunta antes: ¿Cómo sabemos que ese es el archivo que usted recibió, y no el que editó anoche? Si la respuesta es "confíe en mí", ya perdiste. Y da igual cuánta razón tengas en el fondo. Este problema no es exclusivo de un juzgado. Lo tiene el auditor que recibe un volcado de logs, el equipo que documenta un incidente, quien conserva la copia de un contrato firmado por correo. En todos los casos hace falta lo mismo: poder demostrar que un conjunto de bytes no cambió desde un momento determinado, y que lo demuestre alguien que no seas tú . Para eso escribí Tunjo : una herramienta en Rust que recorre un material en solo lectura, calcula su huella y firma un acta verificable por cualquiera. Por qué un árbol y no un hash Lo obvio sería concatenar todo y sacar un SHA-256. Funciona, y es inútil en la práctica. Cuando alguien discute un archivo —un correo concreto entre cuatro mil— con un hash único solo puedes ofrecer dos cosas: o entregas el conjunto completo para que se recalcule, o pides que te crean. La primera opción expone material que no tiene por qué exponerse; la segunda no es una prueba. Un árbol de Merkle resuelve exactamente eso. Cada archivo es una hoja, cada par de nodos se combina hacia arriba y queda una raíz. Para demostrar que una hoja pertenece a esa raíz basta con exhibir esa hoja y el camino de hashes hasta arriba: unos pocos kilobytes. El resto del conjunto no se toca. Dos detalles del árbol que no son opcionales: // Separación de dominio: una hoja nunca puede hacerse pasar por nodo interno. h . update ([ 0x00 ]); // hoja h . update ([ 0x01 ]); // nodo interno // Y la raíz ata el número de hojas. h . update ([ 0x02 ]); h . update ( n . to_be_bytes ()); Sin lo primero, un hash de hoja podría presentarse como si fuera un nodo del árbol. Sin lo segundo aparece la ambigüedad clásica de los árboles con número impar de hojas: dos conjuntos distintos pued

When engineers discuss quantum computing, the conversation usually focuses on future supercomputers cracking traditional encryption passwords in a matter of seconds. As a systems architect who spends my days building distributed platforms, which are networks of independent cloud servers working together as a single application, I see a different, highly practical challenge taking shape. The transition to quantum-resistant security is not simply a theoretical math problem. It is an infrastructure challenge that will directly impact network throughput, memory usage, and messaging efficiency across global cloud environments. To protect sensitive enterprise records and business platforms against future quantum threats, security organizations are transitioning to Post-Quantum Cryptography. This field involves building new mathematical algorithms that quantum computers cannot easily solve. However, these stronger defense mechanisms come with a major trade-off in size. Traditional cryptographic signatures, which are digital verification stamps used to prove that a data message comes from an authentic sender and was not altered, are remarkably small. An older, standard signature might only take up sixty bytes of memory. By comparison, a quantum-safe signature can easily require several thousand bytes. In a simple website, adding a few extra kilobytes to a security header goes unnoticed. But modern cloud infrastructure relies heavily on event-driven architecture, a design strategy where dozens of microservices communicate by constantly publishing tiny, real-time updates to shared message queues. In these systems, the actual business payload might only be a small status change containing twenty bytes of text. If the quantum security stamp attached to that message is three thousand bytes, the overhead of the security layer completely outweighs the actual data being sent. When security footprints expand by orders of magnitude, the physical realities of computer networking take

Probabilistic Graph Neural Inference for bio-inspired soft robotics maintenance with ethical auditability baked in I remember the moment it clicked. I was hunched over a workbench in my home lab, staring at a tangled mess of silicone tentacles—a soft robotic octopus arm I’d 3D-printed and embedded with pneumatic channels. The arm was supposed to mimic the graceful, adaptive movements of a real cephalopod, but after a few cycles, it had developed a slow leak at one of the joint interfaces. The pressure sensors were giving erratic readings, and my traditional rule-based diagnostic script was useless. I’d spent weeks training a simple neural network to detect anomalies, but it kept flagging benign sensor noise as critical failures. That’s when I stumbled upon a paper on probabilistic graph neural networks (PGNNs) for molecular dynamics, and I realized: soft robotics maintenance isn’t about deterministic predictions—it’s about reasoning under uncertainty over a complex, interconnected system. This article is the story of how I built a PGNN-based inference system for bio-inspired soft robots, with ethical auditability baked in from the ground up. Technical Background: Why Soft Robotics Needs Probabilistic Graph Inference Soft robotics is fundamentally different from rigid robotics. A rigid arm has well-defined joints, links, and sensors; failures are often binary (motor burnout, gear slip). But a soft robotic tentacle is a continuum of deformable material with distributed sensing and actuation. The system’s state is a high-dimensional, partially observable probability distribution over material strains, pressures, and temperatures. Traditional diagnostic models—like support vector machines or feedforward neural networks—treat each sensor as an independent feature, ignoring the spatial and temporal dependencies that define soft robot behavior. In my research of graph neural networks, I realized that a soft robot is naturally a graph: each sensor node (pressure, strain, te

Introduction Having laid out some mathematical foundations in the [previous part][1], we will proceed to discuss quantum gates and circuits in depth here. As usual, we will drive home the theories with worked examples from [@Rieffel2011] and check their accuracy with qiskit and/or cirq code. Prerequisite Understanding quantum gates and circuits will be greatly aided by the knowledge of classical gates (AND, OR, NOT, XOR and the universal gates: NAND and NOR). Also, some familiarity with the Python programming language will help you understand qiskit and/or cirq code. Classical & Quantum gates A classical computer, possibly the one you're reading this with, is a sophisticated engineering piece, no doubt. However, the underlying "magic" comprises logic gates. The National Institute of Standards and Technology (NIST) gives this incredible analogical description of classical computers in relation to logic gates [@NISTQGATE2026]: Traditional computers are like microscopic cities. The roads of these cities are wires with electricity coursing through them. These roads have lots of gates, known as logic gates, which enable computers to do their job. Like physical gates that allow or block cars, logic gates allow or block electricity. Electricity that goes through the gates represents a “1” of digital data, and blocked electricity is a “0.” When you pick up a motherboard, for instance, you may not see the said gates as they are made of tiny transistors (in modern systems, MOSFETs) in specific combinations. Also, the $0$ and $1$ referred to in the analogy mean low and high voltage ranges, respectively. Their actual voltage values depend on the hardware. :::note All schematics were written in and rendered by @schemd/core . Check it out. ::: Logic Gates refresher Since we will be realizing some classical circuits using quantum gates, it's necessary to get familiar with common logic gates. NOT ($\neg$) Gate This gate takes a single classical bit and flips it. For instance, if $0

Like its U.S. counterpart, the European Chips Act aims to foster the semiconductor industry — in part thanks to state subsidies. One of the beneficiaries is QuantumDiamonds, a German startup that applies a novel approach to inspecting chips.

France is accelerating its transition to post-quantum encryption: France’s cybersecurity agency ANSSI said on Tuesday it would stop certifying security products that lack quantum-resistant encryption, a move that will force government bodies and critical operators to shift away from older systems. Samih Souissi, ANSSI’s chief of staff, said at the France Quantum conference that the agency would halt such certifications from 2027, and that businesses should be buying only quantum-safe products by 2030. ANSSI approval is required for use in French government agencies and critical infrastructure, making the policy a de facto phase-out of older encryption...

placeholder

[Excerpted from THE QUANTUM COLLAPSE CHRONICLES — not science fiction, but a grounded forecast of what may come when quantum computation dismantles the cryptographic foundations of our digital civilization. These articles explore the collapse of computational trust and the brutal reconstruction of the world that follows.] The history of human civilization is often defined by sudden, violent shifts in the nature of power. We speak of the fall of empires, the industrial revolutions, and the splitting of the atom. But in the mid-2030s, the world experienced a collapse that was not made of steel or stone, but of mathematics. It was a quiet, clinical, and utterly devastating unraveling of the digital fabric that held modern society together. To understand The Quantum Collapse , one must look past the headlines of the era and into the humming, sub-Kelvin depths of the dilution refrigerators that changed everything. This is the story of how the transition from probabilistic experimentation to deterministic computation rendered the world's secrets transparent and its economies obsolete. The Death of Noise: The Rise of Dr. Aris Thorne For the first three decades of the 21st century, quantum computing was a game of chance. Scientists operated in the era of Noisy Intermediate-Scale Quantum (NISQ) devices—machines so temperamental and prone to error that every calculation was a desperate struggle against environmental noise. In those days, a single stray photon or a microscopic fluctuation in temperature could collapse a delicate superposition, turning a groundbreaking calculation into useless digital static. The turning point arrived in 2036 at the Institute for Advanced Quantum Engineering (IAQE) in the High Sierras. The air in the facility didn't vibrate with the erratic drone of the late 2020s; instead, it carried a heavy, rhythmic thrum—the sonic signature of the Lattice-Array-9 (LA-9). At the center of this revolution was Dr. Aris Thorne, the lead architect of the LA-9 pr

Quantum Space says SPACs aren't dead as it seeks a $1.2 billion deal to build military spacecraft.