KXCO Put Its Quantum Cryptography in Public, With the Receipts Attached

A sufficiently large quantum computer breaks RSA and elliptic curve cryptography. Not weakens them. Breaks them. Those two algorithms sit under nearly every private connection, signed document, payment message and software update in use today.

Nobody knows the date. That turns out not to matter, and the reason is the part most institutions have not absorbed.

Harvest now, decrypt later

An adversary does not need the machine today. They need your traffic today and the machine eventually. Anything recorded now, encrypted with today's algorithms, becomes readable the day that machine exists.

For a message with a short life, that is survivable. For a contract, a medical record, a title deed or a payment instruction with a thirty year life, the deadline has already passed. The data being created this week is the data that will be exposed.

This is why the timetables read the way they do. NIST published the replacement standards in August 2024: FIPS 203, 204 and 205. The NSA requires the new algorithms for national security systems on a schedule ending in 2033. United States federal systems are to be off the old algorithms by 2035. The G7 published a roadmap for the financial sector in January.

None of those is the real deadline. The real one is behind us.

What KXCO did

KXCO rebuilt the cryptography under its platform on the NIST standards, and then published it. Fourteen packages, Apache-2.0 licensed, on the public npm registry, where anyone can install them, read the source and run the tests.

Publishing was the hard part, and it was the point. A vendor who tells you their cryptography is sound is asking for trust. A vendor who hands you the code, the test results and the means to reproduce both is not asking for anything at all.

The packages are not a side product. They are the layer everything else stands on. When KXCO Meridian signs a document, this is what signs it. When the Armature L1 ledger records a decision, this is the signature in that record. When Purse holds a key, this is the key format. When an agent acts under the Kinetic Layer, this is the identity that establishes which agent, acting under whose authority.

That concentration cuts both ways, and it is the argument for going public. A weakness in this layer would be a weakness everywhere at once. The layer with the widest blast radius is the one that most needs outside eyes.

Four things anyone can check

Anyone can say their cryptography is correct. These are the ways to find out.

It computes what the standard says. The package runs against NIST's own ACVP test vectors on every change: 2,103 cases, zero failures. The vectors are fetched from NIST rather than bundled, and verified against published digests, so a silently altered upstream fails the build rather than changing the answer.

It works with other people's software. Passing NIST's vectors proves agreement with NIST. It does not prove a counterparty on different software can read what you sign. So the suite tests in both directions against liboqs, the reference C implementation the field measures itself against, Bouncy Castle, used widely across banking, and two Python libraries written independently from the specification. 225 checks, zero failures.

That count includes negative controls, which is the part usually missing. A tampered signature the peer must reject. A corrupted ciphertext that must produce an unrelated secret rather than an error. Without those, a peer whose verification function returned true unconditionally would pass every other check in the matrix.

The published file is the published source. Every release carries a provenance attestation tying the file on the registry to the exact commit and build that produced it. Beyond that, the file rebuilds from its own source byte for byte, checked on every run. The first says a build happened in CI. The second says the artefact is the source. They are different claims and the project makes both.

You can see what is inside. Every release publishes a CycloneDX bill of materials at a permanent public address requiring no login.

The month the tests earned their keep

On 31 August a routine dependency update failed the conformance job. The underlying library had shipped a new version four days earlier, and nine of NIST's own test vectors came back wrong: valid signatures of one type were being rejected.

Nothing in that release's notes suggested anything of the sort. They described option-handling hardening.

KXCO had already shipped it. Within the hour it was reverted, the affected release was deprecated on the public registry with an explanation pointing at the fix, and a rule was added so the faulty version cannot be reintroduced.

A test suite that passes proves very little. A test suite that catches a fault nobody was looking for, in a dependency nobody had reason to distrust, is the only kind worth maintaining. The entire sequence sits in the public changelog, written plainly rather than reverted quietly.

Also this month

The mathematics now runs in C rather than JavaScript wherever the platform allows it. On current versions of Node the primitives are executed by OpenSSL 3.5. Signing is roughly six times faster, and the worst case is nine times tighter, which matters more than the average when a system has a deadline. Both paths are tested against each other on every build, because two implementations that are supposed to agree have to be shown to agree.

A third independent implementation was added to the interoperability testing. Supply chain evidence went from four packages to twelve. Stale performance figures were remeasured and replaced, and documentation that pointed a reviewer at an address that no longer worked now points at the public ledger, where the check does not depend on KXCO at all.

That last category is the one worth weighing. Adding a capability is easy. Going back through your own published claims looking for the ones that have quietly stopped being true, and correcting them in public with a date attached, is the habit that separates an engineering culture from a marketing one.

Why it matters commercially

Three reasons, in order of weight.

The deadline is real and most institutions have not started. Those who move early do it calmly, on their own schedule. Those who wait will do it under a regulator's timetable, at a price set by whoever is selling.

This is the layer everything else needs. Identity, permission, payment and audit all rest on being able to prove who said what, and that proof is precisely what quantum computing removes. Replacing it is not a feature.

And independent assessment is coming to this category. Assessors look for conformance against official vectors, agreement with other implementations, provenance on releases, a published bill of materials and honest documentation of limits. Most vendors have none of it while claiming all of it.

Check it yourself

The packages are at npmjs.com/~kxco. Fourteen of them, with publication dates, version history and full source. Run npm audit signatures against any one to check its provenance. The conformance suite runs from two commands in the base package's documentation, and it fetches NIST's vectors from NIST.

There is a live production check too. Every article published on Live Trading News is signed with ML-DSA-65 and anchored on the Armature L1 chain at the moment of publication. The page declares the signing key, the envelope digest and the transaction. Query the chain over public JSON-RPC and the same values come back. The page claims, the chain confirms, and the two were written by different systems at different times.

That includes this article.

The post-quantum work described here was written and directed by Shayne Heffernan, founder of KXCO, with the engineering team led by John Heffernan. Every commit, release and correction is on the public record.

Shayne Heffernan, Ph.D., is the founder of Live Trading News, the KnightsBridge Group, Knightsbridge Law and the KXCO.ai ecosystem spanning post-quantum cryptography, identity, attestation and enterprise ontology.