// Technology / Post-Quantum Readiness

Crypto migration is an operational problem.

QHx supports NIST-standardized ML-DSA signatures, ML-KEM key exchange, hybrid modes, and per-namespace algorithm policy.

QHx PKIPQC dispatch →

// Mechanism

The algorithm belongs in policy.

QHx moves cryptographic selection into cluster and namespace policy so teams can test, stage, roll back, and modernize without rewriting every workload.

  • ML-DSAFIPS 204 signatures for workload SVIDs, with selectable security levels.
  • ML-KEMFIPS 203 key encapsulation for TLS, including hybrid classical-and-PQ modes.
  • Algorithm diversityReduces single-algorithm dependency across the credential lifecycle.
  • Implementation safetyNIST-standardized APIs reduce the surface for implementation error.
  • Per-namespace policyDifferent namespaces can run different algorithm profiles during migration. Crypto choice is a policy decision, not a workload code change.
  • CompatibilityConventional algorithms remain available where transition constraints require them.
SIGNATURE POLICY

Default: mldsa65

Alternates: mldsa44, mldsa87

KEY EXCHANGE

Hybrid: p384-mlkem1024

Pure PQ: mlkem768 / mlkem1024