KXCO Upgrades Its Post-Quantum Stack: 3,522 NIST Test Cases, Zero Failures
The new self-testing entry point passed every one of the 3,522 test cases NIST's Demo test server graded. The HSM package can now keep ML-KEM keys on the token, and the scanner dates every quantum-vulnerable finding to IR 8547.
Part of theKXCO Center
On 29 October 2026, KXCO shipped an upgrade across its post-quantum stack: 15 releases of 14 packages on npm, every one with an SLSA provenance attestation that ties it to the source and build that produced it. The new self-testing entry point in the core library ran NIST's own test vectors on NIST's Demo test server and passed all 3,522 test cases, with zero failures.
KXCO's post-quantum page calls these packages "the cryptography that KXCO's products are built on", and its architecture page says "Everything KXCO ships stands on the same cryptography." KXCO has 8 products: Round Table, Portcullis, Herald, Sovereign, Guildhall, Hanse, Armature and Athanor, the KXCO engineering lab, an internal facility. One install, kxco-pq 3.0.1, brings 11 more KXCO packages, the core among them, at their new versions.
Ahead of the deadlines
NIST published the final version of IR 8547, Transition to Post-Quantum Cryptography Standards, in October 2026. It states that "NIST will deprecate all quantum-vulnerable cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035." It also records that Executive Order 14412 and OMB Memorandum M-26-15 require the US government's most sensitive systems to adopt post-quantum cryptography for key establishment by 31 December 2030, and for digital signatures by 31 December 2031.
KXCO's packages supply both today: ML-KEM for key establishment and ML-DSA for signatures, the FIPS 203 and FIPS 204 standards. Five of them default to the strongest sets, the Category 5 sets that CNSA 2.0 names: kxco-pq-tls and kxco-pq-vault use ML-KEM-1024, and kxco-pq-sdk, kxco-pq-agent and kxco-pq-hsm use ML-DSA-87. IR 8547 recommends ML-KEM-768 as the general default and other sets "when higher security is required": ML-KEM-1024 is the higher-security set.
3 capabilities added in this upgrade
A self-testing entry point. kxco-post-quantum 1.13.0 adds kxco-post-quantum/fips, a separate entry point designed against the FIPS 140-3 Level 1 software requirements.
Before any service loads, it checks every one of its files against a manifest signed with KXCO's ML-DSA-87 release key.
It runs known-answer self-tests taken from NIST's own ACVP vectors, and it tests every key pair it generates.
It takes every random value from an HMAC_DRBG with SHA-512.
After any failure it refuses every service until the process restarts.
It offers ML-KEM-768, ML-KEM-1024, ML-DSA-65 and ML-DSA-87.
NIST's Demo test server graded this code on 28 October 2026 in session 783228: 13 vector sets covering ML-KEM, ML-DSA, SHA-2, SHA-3, SHAKE, HMAC and the random bit generator, 3,522 test cases, all passed. KXCO published the results with the environment they ran in.
The packages also rest on published evidence: KXCO's evidence document reports 1,793 NIST ACVP test vectors passed, 225 interoperability checks against liboqs, Bouncy Castle and the Python reference implementations, in both directions, with zero failures, and published tarballs that rebuild byte for byte from their own tags.
ML-KEM keys that can stay on the token. kxco-pq-hsm can now generate ML-KEM-1024 and ML-KEM-768 keys on a PKCS#11 v3.2 token and decapsulate there, through the standard C_DecapsulateKey call. The private key is marked sensitive and unextractable, so it never enters the application's memory. ML-DSA-87 and ML-DSA-65 signing keys already worked this way, so both halves of the post-quantum toolkit can now run on the token. KXCO tests the ML-KEM path against a PKCS#11 v3.2 software token.
NIST's dates on every quantum-vulnerable finding. kxco-pq-scan 1.4.0, the free scanner, now stamps each quantum-vulnerable finding with the IR 8547 dates: deprecated after 2030, disallowed after 2035. The dates appear in the report, in the JSON output and on each quantum-vulnerable algorithm in the scanner's CycloneDX cryptography bill of materials (CBOM). The scanner also names the MD5, SHA-1, RC4 and Triple DES that the crypto-js library ships, and it carries NIST's note that SHA-1 will be disallowed in FIPS-validated modules after 2030.
The kxco-post-quantum/fips entry point has not yet been through a laboratory or NIST's certification programme.
What the upgrade means for each product
Every link between products below is one KXCO states on its products page or on the product's own page, each is described as live, designed or in development as that page marks it, and every status is copied from the product's own page.
Portcullis (live in parts) finds quantum-vulnerable cryptography across an estate. Its free scan is kxco-pq-scan. When version 1.4.0 finds quantum-vulnerable cryptography, its report gives the year NIST will deprecate it and the year NIST will disallow it, and its JSON output stamps each finding with both. A security team can put both dates straight into its migration plan.
Round Table (live, private deployments) sits at the centre. It can read findings from Portcullis and attestations from Herald as sourced claims.
Herald (live for domains, documents, people and agents) is identity and signatures, and KXCO anchors its credentials on Armature. Four upgraded packages do identity and signing in code: for signed envelopes, institution identity, keys for AI agents and key management at the terminal. Each release requires kxco-post-quantum 1.13.0, and the institution identity and agent packages issue ML-DSA-87 keys by default. The institution identity package, kxco-pq-sdk, can sign through kxco-pq-hsm, which can now keep ML-KEM keys on the token as well as ML-DSA keys. Herald is designed to supply the identity of the parties in a Guildhall room, the senders and receivers in Hanse, and the signer of a Portcullis release.
Armature (live) is the post-quantum settlement network and public record. It checks ML-DSA-87 and ML-DSA-65 signatures on chain and attests each finalised block with ML-DSA-87. Both Armature-facing packages moved onto 1.13.0. The first, kxco-pq-chain 2.4.2, posts signed intents for Armature to verify in consensus, and its test suite checks the operation tags it derives against the contract deployed on Armature. The second, kxco-pq-network 1.2.1, checks an envelope at three levels: the signature, the Armature anchor it carries, and a live answer from KXCO's key registry that the signing key is still trusted.
Sovereign (live) is software for holding and moving value, and it settles on Armature. Licensed institutions hold assets. KXCO supplies the software.
Guildhall (live) is where Members run their deals. Settlement can use Sovereign or the Member's own custodian, and Round Table Review supports larger transactions.
Hanse (in development) is designed to run on Sovereign, with Herald identities for senders and receivers and Armature for the record. No launch date is set.
Athanor (an internal facility) is the KXCO engineering lab.
Check it yourself
Three commands, run from a terminal without an account, scan your own project, install the packages and check their signatures:
npx kxco-pq-scan scans the JavaScript dependencies of the project in the current folder.
npm install [email protected] installs kxco-pq and 11 more KXCO packages.
npm audit signatures checks the registry signatures and provenance attestations of everything installed.
KXCO ran the install on Linux on 29 October 2026: the self-testing entry point reported operational, an ML-DSA-87 signature verified, and an ML-KEM-1024 key exchange produced matching secrets.
What to watch
IR 8547 says a shared secret from ML-KEM may serve as Z in the composite key-establishment mode of SP 800-56C, and that NIST intends to update SP 800-56C to name FIPS 203 among the sources of Z. Anyone running a hybrid key exchange should watch for that update.
Shayne Heffernan, Ph.D., is the founder of the KnightsBridge Group (shayneheffernan.com).
Our Consciousness Is Linked to Our Humanity, and AI Should Extend It
The only systems in which science has strong evidence of consciousness are living animals, and the only consciousness any of us knows from the inside is human. Shayne Heffernan argues that our consciousness is linked to our humanity: it grows out of a body keeping itself alive and becomes a self through a human upbringing. AI can extend that consciousness. On today's evidence it does not share it, so AI should be built as an instrument of human minds.
United States vs China: AI Models, Compute, Quantum and Electricity
The United States still leads in frontier model capability, total AI compute and quantum error correction, while China has narrowed the gaps in model performance, open-weight adoption and domestic chip volumes, and holds a structural advantage in power for data centres. Shayne Heffernan sets out the developments from July to October 2026 across models, compute, quantum and electricity, and how fast China is catching up.
The 2030 Compute Landscape: GPUs, Power and the Architecture of Intelligence
The constraint on AI is no longer ideas or data but compute and the power to run it. Frontier training compute has grown about five times a year since 2020, and the leading AI supercomputer of June 2030 is on course for about 2 million chips and 9 gigawatts. Shayne Heffernan sets out the 2030 arithmetic, the power problem, who has already contracted the gigawatts, and how GPUs, custom ASICs, wafer-scale engines and quantum machines divide the work.
Harvest Now, Decrypt Later: Why KXCO Took Its Ontologies Private
For more than 90 days KXCO ran its ontologies in public: the AI sector resolved from six names to one lithography supplier, and Australia's trade with the United States as one sourced record. They proved the method. They are now private, still running, for KXCO and its clients only. Europol's report on harvest now, decrypt later explains why: data collected today will be read when a quantum computer arrives, and a graph of your relationships is the most valuable thing to harvest.
Every story, signed and delivered.
Subscribe to the kxco channel and get the headline, the AI-written key takeaways, and the chain-anchor link the moment we publish. Audio versions and per-ticker subscriptions arrive in the next iteration.