xBridge-PQ: Post-Quantum Key Distribution

The Problem

Current key exchange protocols (RSA, ECDH) will be broken by cryptographically relevant quantum computers. Harvest-now-decrypt-later is already an active nation-state strategy.

Intelligence agencies are capturing encrypted traffic today with the intent to decrypt it when quantum computers become available. A classified document encrypted with RSA-2048 or ECDH P-256 has a shelf life — once a sufficiently large quantum computer runs Shor's algorithm, every intercepted ciphertext becomes plaintext.

NIST has standardized post-quantum algorithms (ML-KEM, ML-DSA), but migrating from classical to post-quantum key exchange is a single-layer replacement. If ML-KEM itself is broken by future cryptanalysis, every channel relying solely on it is compromised. The industry needs defense-in-depth — not just a new algorithm, but a fundamentally different security model.

The Old Way

The PRIVATE.ME Solution

Double-layered quantum safety: XorIDA provides information-theoretic security (no computation breaks it), while ML-KEM adds a post-quantum computational layer. Breaking both simultaneously is impossible.

Layer 1: XorIDA splits data into K-of-N shares distributed across independent channels. This layer is information-theoretically secure — no quantum computer, no matter how powerful, can extract data from fewer than K shares. This is not a computational assumption; it is a mathematical proof.

Layer 2: Each share is additionally encrypted with an ML-KEM-encapsulated shared secret. Even if an adversary captures all N shares (breaking the channel separation), they still need to break ML-KEM to decrypt individual shares. The two layers are independent — breaking one does not help break the other.

The New Way

How It Works

A five-stage pipeline: ML-KEM key establishment, XorIDA threshold split, per-share KEM encryption, multi-channel distribution, and verified double-layer reconstruction.

Use Cases

Integration

import { establishQuantumChannel, exchangeKey } from '@private.me/xbridge-pq';

// Establish a quantum-safe channel (ML-KEM-768, 2-of-3)
const channel = await establishQuantumChannel({
  kemAlg: 'ML-KEM-768',
  n: 3,
  k: 2
});

// Exchange key material over the double-layered channel
const result = await exchangeKey(channel, keyMaterial);
if (result.ok) {
  // result.value contains verified key material
  deriveSessionKey(result.value);
}

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xBridge-PQ?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xBridge-pq generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases