# KXCO Upgrades Its Post-Quantum Stack: 3,522 NIST Test Cases, Zero Failures The new self-testing entry point passed every one of the 3,522 test cases NIST's Demo test server graded. The HSM package can now keep ML-KEM keys on the token, and the scanner dates every quantum-vulnerable finding to IR 8547. Canonical HTML: https://www.livetradingnews.com/kxco-upgrades-its-post-quantum-stack-3522-nist-test-cases-zero-failures Last modified: 2026-10-29 --- By Shayne Heffernan ยท 2026-10-29 Tags: post-quantum cryptography, PQC, ML-KEM, ML-DSA, NIST IR 8547, FIPS 203, FIPS 204, HSM, PKCS#11, CBOM, KXCO, quantum security, npm Signed: ML-DSA-87, anchored on Armature L1. Nothing in this article is investment advice. On 29 October 2026, KXCO shipped an upgrade across its post-quantum stack: 15 releases of 14 packages on npm, every one with an SLSA provenance attestation that ties it to the source and build that produced it. The new self-testing entry point in the core library ran NIST's own test vectors on NIST's Demo test server and passed all 3,522 test cases, with zero failures. KXCO's [post-quantum page](https://kxco.ai/post-quantum/) calls these packages "the cryptography that KXCO's products are built on", and its [architecture page](https://kxco.ai/architecture/) says "Everything KXCO ships stands on the same cryptography." KXCO has 8 products: Round Table, Portcullis, Herald, Sovereign, Guildhall, Hanse, Armature and Athanor, the KXCO engineering lab, an internal facility. One install, [kxco-pq 3.0.1](https://www.npmjs.com/package/kxco-pq), brings 11 more KXCO packages, the core among them, at their new versions. ## Ahead of the deadlines NIST published the final version of [IR 8547](https://csrc.nist.gov/pubs/ir/8547/final), Transition to Post-Quantum Cryptography Standards, in October 2026. It states that "NIST will deprecate all quantum-vulnerable cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035." It also records that Executive Order 14412 and OMB Memorandum M-26-15 require the US government's most sensitive systems to adopt post-quantum cryptography for key establishment by 31 December 2030, and for digital signatures by 31 December 2031. KXCO's packages supply both today: ML-KEM for key establishment and ML-DSA for signatures, the FIPS 203 and FIPS 204 standards. Five of them default to the strongest sets, the Category 5 sets that CNSA 2.0 names: kxco-pq-tls and kxco-pq-vault use ML-KEM-1024, and kxco-pq-sdk, kxco-pq-agent and kxco-pq-hsm use ML-DSA-87. IR 8547 recommends ML-KEM-768 as the general default and other sets "when higher security is required": ML-KEM-1024 is the higher-security set. ## 3 capabilities added in this upgrade **A self-testing entry point.** kxco-post-quantum 1.13.0 adds kxco-post-quantum/fips, a separate entry point designed against the FIPS 140-3 Level 1 software requirements. - Before any service loads, it checks every one of its files against a manifest signed with KXCO's ML-DSA-87 release key. - It runs known-answer self-tests taken from NIST's own ACVP vectors, and it tests every key pair it generates. - It takes every random value from an HMAC_DRBG with SHA-512. - After any failure it refuses every service until the process restarts. - It offers ML-KEM-768, ML-KEM-1024, ML-DSA-65 and ML-DSA-87. NIST's Demo test server graded this code on 28 October 2026 in session 783228: 13 vector sets covering ML-KEM, ML-DSA, SHA-2, SHA-3, SHAKE, HMAC and the random bit generator, 3,522 test cases, all passed. KXCO [published the results](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/tree/main/conformance/results/acvts-demo-2026-10-28/session-783228) with the environment they ran in. The packages also rest on published evidence: KXCO's evidence document reports 1,793 NIST ACVP test vectors passed, 225 interoperability checks against liboqs, Bouncy Castle and the Python reference implementations, in both directions, with zero failures, and published tarballs that rebuild byte for byte from their own tags. **ML-KEM keys that can stay on the token.** [kxco-pq-hsm](https://www.npmjs.com/package/kxco-pq-hsm) can now generate ML-KEM-1024 and ML-KEM-768 keys on a PKCS#11 v3.2 token and decapsulate there, through the standard C_DecapsulateKey call. The private key is marked sensitive and unextractable, so it never enters the application's memory. ML-DSA-87 and ML-DSA-65 signing keys already worked this way, so both halves of the post-quantum toolkit can now run on the token. KXCO tests the ML-KEM path against a PKCS#11 v3.2 software token. **NIST's dates on every quantum-vulnerable finding.** [kxco-pq-scan 1.4.0](https://www.npmjs.com/package/kxco-pq-scan), the free scanner, now stamps each quantum-vulnerable finding with the IR 8547 dates: deprecated after 2030, disallowed after 2035. The dates appear in the report, in the JSON output and on each quantum-vulnerable algorithm in the scanner's CycloneDX cryptography bill of materials (CBOM). The scanner also names the MD5, SHA-1, RC4 and Triple DES that the crypto-js library ships, and it carries NIST's note that SHA-1 will be disallowed in FIPS-validated modules after 2030. The kxco-post-quantum/fips entry point has not yet been through a laboratory or NIST's certification programme. ![Exhibit 1: what one install of kxco-pq 3.0.1 brings, each package at its 29 October 2026 release, each requiring kxco-post-quantum 1.13.0](https://livetradingnews-media.nyc3.digitaloceanspaces.com/media/2026/10/29/cmpgg3-2af3ca6e42942516.svg) ## What the upgrade means for each product Every link between products below is one KXCO states on its [products page](https://kxco.ai/products/) or on the product's own page, each is described as live, designed or in development as that page marks it, and every status is copied from the product's own page. **Portcullis** (live in parts) finds quantum-vulnerable cryptography across an estate. Its free scan is kxco-pq-scan. When version 1.4.0 finds quantum-vulnerable cryptography, its report gives the year NIST will deprecate it and the year NIST will disallow it, and its JSON output stamps each finding with both. A security team can put both dates straight into its migration plan. **Round Table** (live, private deployments) sits at the centre. It can read findings from Portcullis and attestations from Herald as sourced claims. **Herald** (live for domains, documents, people and agents) is identity and signatures, and KXCO anchors its credentials on Armature. Four upgraded packages do identity and signing in code: for signed envelopes, institution identity, keys for AI agents and key management at the terminal. Each release requires kxco-post-quantum 1.13.0, and the institution identity and agent packages issue ML-DSA-87 keys by default. The institution identity package, kxco-pq-sdk, can sign through kxco-pq-hsm, which can now keep ML-KEM keys on the token as well as ML-DSA keys. Herald is designed to supply the identity of the parties in a Guildhall room, the senders and receivers in Hanse, and the signer of a Portcullis release. **Armature** (live) is the post-quantum settlement network and public record. It checks ML-DSA-87 and ML-DSA-65 signatures on chain and attests each finalised block with ML-DSA-87. Both Armature-facing packages moved onto 1.13.0. The first, kxco-pq-chain 2.4.2, posts signed intents for Armature to verify in consensus, and its test suite checks the operation tags it derives against the contract deployed on Armature. The second, kxco-pq-network 1.2.1, checks an envelope at three levels: the signature, the Armature anchor it carries, and a live answer from KXCO's key registry that the signing key is still trusted. **Sovereign** (live) is software for holding and moving value, and it settles on Armature. Licensed institutions hold assets. KXCO supplies the software. **Guildhall** (live) is where Members run their deals. Settlement can use Sovereign or the Member's own custodian, and Round Table Review supports larger transactions. **Hanse** (in development) is designed to run on Sovereign, with Herald identities for senders and receivers and Armature for the record. No launch date is set. **Athanor** (an internal facility) is the KXCO engineering lab. ![Exhibit 2: the 3 products the upgraded packages relate to directly, and 3 of the links KXCO marks live between its products, with each product's published status](https://livetradingnews-media.nyc3.digitaloceanspaces.com/media/2026/10/29/cmpgg3-a037770546dc1e0a.svg) ## Check it yourself Three commands, run from a terminal without an account, scan your own project, install the packages and check their signatures: - **npx kxco-pq-scan** scans the JavaScript dependencies of the project in the current folder. - **npm install kxco-pq@3.0.1** installs kxco-pq and 11 more KXCO packages. - **npm audit signatures** checks the registry signatures and provenance attestations of everything installed. KXCO ran the install on Linux on 29 October 2026: the self-testing entry point reported operational, an ML-DSA-87 signature verified, and an ML-KEM-1024 key exchange produced matching secrets. ## What to watch IR 8547 says a shared secret from ML-KEM may serve as Z in the composite key-establishment mode of SP 800-56C, and that NIST intends to update SP 800-56C to name FIPS 203 among the sources of Z. Anyone running a hybrid key exchange should watch for that update. Shayne Heffernan, Ph.D., is the founder of the KnightsBridge Group ([shayneheffernan.com](https://www.shayneheffernan.com)). --- This Markdown mirrors https://www.livetradingnews.com/kxco-upgrades-its-post-quantum-stack-3522-nist-test-cases-zero-failures. The HTML page is canonical. Site index for AI clients: https://www.livetradingnews.com/llms.txt