KXCO Upgrades Its Post-Quantum Security Stack to the Full NIST Trio
KXCO has added SLH-DSA (FIPS 205) and modernised its open-source post-quantum cryptography engine — completing the full NIST trio of ML-KEM, ML-DSA and SLH-DSA across identity, signing, the Armature chain, treasury and wallet products, and proving the migration changed nothing already signed.
Part of theAI Stocks Center
The quantum-security race is not a future problem to be scheduled — it is a present engineering discipline. This week KXCO advanced its open-source post-quantum cryptography foundation to the full set of ratified NIST standards, and pushed the improvement through every product built on it.
Post-quantum security has moved from research to regulation. In August 2024 the U.S. National Institute of Standards and Technology (NIST) finalised the first three standards designed to withstand attack by large-scale quantum computers: FIPS 203 (ML-KEM) for key encapsulation, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) for hash-based signatures. The migration clock is running — national-security systems face mandated timelines, and regulated financial institutions serving U.S. and EU counterparties will inherit the same quantum-security expectations with less lead time than most expect.
KXCO built for this from the start. This week we closed the last gap between our published post-quantum foundation and the complete NIST standard set — and we did it in the open, where anyone can verify it.
What KXCO upgraded
Three changes, across thirteen open-source post-quantum packages:
Added SLH-DSA (FIPS 205). Our flagship library, `kxco-post-quantum`, now ships all three ratified NIST post-quantum algorithms — ML-KEM-768, ML-DSA-65, and SLH-DSA-SHA2-192s — at NIST Security Category 3. That completes the quantum-safe trio in the one package every other component builds on.
Modernised the primitive engine. We advanced the underlying reference implementation to its current release, which carries the final FIPS 203/204/205 code. Critically, we verified through a full battery of pinned test vectors that every key and signature our systems already produce remains byte-for-byte identical under the new engine — including the identities anchored on our Armature chain since genesis. Modernisation with zero disruption.
Aligned the whole family. The upgrade was rolled through all thirteen
kxco-post-quantum,kxco-pq-*and `kxco-verify` packages, so the entire post-quantum suite now resolves to the same current, inspectable engine.
Every change is public and permanent. The code is live on npm and GitHub, versioned and installable by anyone, with a full commit history that shows sustained work rather than a one-off drop. You do not have to take our word for any of it — that is the point.
Why it matters for quantum security
Algorithm diversity is resilience. ML-DSA and ML-KEM rest on the hardness of structured-lattice problems. SLH-DSA rests on something entirely different — the security of hash functions, with no lattice or number-theoretic assumptions at all. Shipping both means that if the cryptographic community's confidence in one family ever shifts, we already have a standardised, deployed alternative on the shelf. For records that must stay provable for decades — legal agreements, audit trails, on-chain history — that hash-based hedge is not a nicety; it is the conservative choice for long-horizon quantum security.
Currency is credibility. A security library whose entire promise is "we track the ratified reference implementation" cannot afford to fall behind it. Bringing the engine to the final FIPS code, and proving the migration changed no outputs, keeps the promise honest.
Verifiability is the product. KXCO's post-quantum foundation is open on purpose. Regulators, security teams and counterparties can read the code, run the test vectors, and confirm every claim independently — the standard we hold ourselves to, and increasingly the standard institutions will demand.
How the upgrade hardens each KXCO product
These packages are not a side project. They are the cryptographic engine inside the KXCO platform — the same primitives, exposed as libraries. Strengthening the foundation strengthens everything above it. Here is what the upgrade means for each product group.
Identity & Verification — KXCOIdentity, KXCO Verified
Institutional credentials and domain or document seals are signed with ML-DSA-65 and independently checkable with `kxco-verify` — the standalone, browser-safe verifier that auditors and counterparties use without installing the full stack. That verifier was brought onto the current engine and re-proven against live attestation fixtures, so third-party verification stays exact. The new hash-based option gives long-lived credentials a second, assumption-independent path to durability. Explore it at verify.kxco.ai.
Document Signing & Data Rooms — KXCO Sign
Agreements signed for multi-decade validity are exactly where algorithm diversity earns its keep. A signature that must survive thirty years of cryptographic progress benefits from having both a lattice-based and a hash-based standard on hand. Sign's hybrid signing and tamper-evident audit logs sit directly on the upgraded primitives. See sign.kxco.ai.
Sentinel — Enterprise AI Trust Platform
Sentinel's entire proposition is post-quantum trust for AI and enterprise systems. Shipping the complete NIST trio and a current engine widens what the platform can attest to and deepens the credibility of every quantum-security report it produces. See pqc.kxco.ai.
Armature — Post-Quantum Layer-1 Chain
Armature has used ML-DSA-65 identities since block zero. The most important result of this upgrade for the chain is what did not change: the compatibility gate proved that every deterministic key derived under the old engine verifies identically under the new one. The chain gets a modern primitive layer with no fork, no re-keying, no disruption. See chain.kxco.ai.
Treasury & Banking — KnightsVault, KXCO Bank
Settlement records, webhook deliveries and audit logs across the treasury and white-label banking products are signed with the hybrid HMAC + ML-DSA-65 pattern and protected with ML-KEM-768 key encapsulation. The family packages that implement attestation, audit and vaulting all now pull the refreshed base, so institutions deploying under their own brand inherit the improvement automatically.
Wallet — KnightsPurse
Post-quantum identity, sync and recovery in the wallet are built on the base and agent packages. Keeping those on the current engine keeps the wallet's quantum-safe guarantees current — for people, and for the AI agents that increasingly hold and move value. See purse.kxco.ai.
A standing commitment to leading the quantum-security race
KXCO's position on quantum security is not a campaign; it is a discipline we intend to stay ahead of. We publish our foundation openly, we track the ratified standards as they finalise, we prove our migrations change nothing we have already signed, and we push improvements through the whole stack rather than a single flagship. Completing the NIST post-quantum trio is one more step in a race we intend to keep leading — well before the deadline that turns it into everyone else's emergency.
Frequently asked questions
Is KXCO quantum-safe? Yes. KXCO is post-quantum by design. Identities, signatures and settlement use ML-DSA-65 (NIST FIPS 204), key encapsulation uses ML-KEM-768 (FIPS 203), and the stack now also ships SLH-DSA (FIPS 205) for hash-based signatures — the full set of ratified NIST post-quantum standards.
What post-quantum algorithms does KXCO use? Three NIST-standardised algorithms at Security Category 3: ML-KEM-768 for key encapsulation, ML-DSA-65 for digital signatures, and SLH-DSA-SHA2-192s for hash-based signatures. These correspond to NIST FIPS 203, 204 and 205 respectively.
What is SLH-DSA (FIPS 205) and why add it? SLH-DSA is a stateless hash-based signature scheme. Its security depends only on the strength of hash functions — not on lattice or number-theoretic assumptions — which makes it a conservative hedge alongside the lattice-based ML-DSA. Having both standardised schemes available is algorithm diversity: resilience if confidence in any one family ever shifts.
Does the upgrade change existing signatures or keys? No. KXCO verified through pinned test vectors that every key and signature produced under the previous engine remains byte-for-byte identical under the new one, including identities anchored on the Armature chain since genesis. The modernisation is fully backward-compatible.
Where can I verify KXCO's post-quantum cryptography? The foundation is open source on npm and GitHub. Anyone can install the packages, read the code, and run the reproducible test vectors. Links are below.
Inspect it yourself
npm: kxco-post-quantum · kxco-verify
GitHub: KnightsbridgeAIQ/kxco-post-quantum · KnightsbridgeAIQ/kxco-verify
Products: KXCO · Verified · Sign & Identity · Sentinel · Armature Chain · KnightsPurse
SpaceX: The AI Company You Might Be Missing
The market watches Falcon 9 and Starlink; it is missing the AI company SpaceX has quietly built — xAI, Colossus, the $55bn Terafab chip fab and orbital data centres. Shayne Heffernan maps SpaceX's position against the KXCO AI Sector Ontology ahead of its IPO.
KXCO Quantum Security 13 Packages, Published for Anyone to Inspect
Most tech companies ask you to trust them; KXCO did the opposite and published its post-quantum security code in the open. Shayne Heffernan on why third-party-verifiable software is the real signal — and what KXCO deliberately kept private.
The AI–Quantum Convergence Is One Problem, Not Two — and It Needs One Environment
AI and quantum are arriving together, and the BIS says the cost falls on defenders. Shayne Heffernan on treating them as one trust problem — and the fact-based, post-quantum environment built to answer it.
Your AI Agent Can Now Own a Wallet — and Keep It
The wallet has always assumed a person is holding the phone. Autonomous AI agents break that assumption. Shayne Heffernan on the self-custodial, quantum-secure wallet built so a machine can own value — and the one line where regulation begins.
Every story, signed and delivered.
Subscribe to the kxco channel and get the headline, the AI-written key takeaways, and the chain-anchor link the moment we publish. Audio versions and per-ticker subscriptions arrive in the next iteration.