DTM™
Post-Quantum Encryption
NIST-Approved Quantum-Resistant Cryptography
NIST PQC Standards Compliant
FIPS 203 (ML-KEM) • FIPS 204 (ML-DSA) • FIPS 205 (SLH-DSA) • CNSA 2.0 Ready
The Post-Quantum Encryption (PQE) module is an enterprise add-on service to the AEGIS platform and DTM™ application. It provides quantum-resistant cryptographic protection using NIST-approved algorithms (FIPS 203, 204, 205).
Why Add PQE?
- Protect sensitive intelligence data from future quantum attacks
- Maintain compliance with emerging quantum-safe standards (CNSA 2.0)
- Future-proof your cryptographic infrastructure
- Hybrid mode: Combines classical + post-quantum for defense-in-depth
What Are PQE Keys?
Post-quantum keys are cryptographic keypairs used for encryption and digital signatures that resist attacks from both classical and quantum computers. Your organization generates these keys to secure communications and data storage.
How to Generate Keys:
- Navigate to the "Key Management" tab
- Click "Generate Key" in the top-right corner
- Select algorithm based on use case:
- ML-KEM-768/1024: For encrypting data at rest and in transit
- ML-DSA-65/87: For digital signatures and authentication
- SLH-DSA: For long-term signatures (hash-based)
- Choose security level (NIST-1, NIST-3, NIST-5) — higher = more secure but larger keys
- Enable hybrid mode to combine with classical algorithms (recommended)
- Set expiration date and assign to specific systems
- Save and store the key ID — the private key remains secured in the system
Note: Keys are generated using NIST-approved algorithms. The private key never leaves the secure environment. Only public key hashes are displayed for verification.
What Are Client Keys?
Client keys are issued to external partners, agencies, or departments who need to securely communicate with your AEGIS/DTM platform using quantum-resistant encryption. Each client receives a unique key pair.
How to Issue Client Keys:
- Go to the "Client Keys" tab
- Click "Issue New Client Key"
- Enter client information:
- Organization/Department name
- Contact email for key administrator
- Purpose of communication (e.g., "Intelligence sharing - FBI")
- Select algorithm and security level (match your organizational keys)
- Set expiration date (recommended: 12-24 months, with rotation)
- Generate the key — system creates and stores the client's public key
- Provide client with their key installation package (see Step 3)
Security: Each client key is uniquely identified and tracked in audit logs. Keys can be suspended or revoked at any time if compromised.
What Are PQE Connections?
Connections are active, quantum-resistant communication channels between your platform and client systems. They use the issued keys to encrypt all data in transit.
How to Create Connections:
- Navigate to the "Connections" tab
- Click "New Connection"
- Configure connection:
- Source system: Your AEGIS/DTM instance
- Destination: Client organization/system
- Select the issued client key
- Choose protocol: TLS-1.3-PQ, IPSec-PQ, or API-PQ
- Enable hybrid mode for backward compatibility
- Test the connection using the built-in handshake verification
- Monitor connection status in real-time (active/pending/suspended)
Connection Monitoring:
- Track bytes encrypted and handshake counts
- Receive alerts for failed handshakes or key expiration
- View connection history and performance metrics
What Clients Receive:
After issuing a client key, you provide them with a secure installation package containing their public key, configuration parameters, and connection instructions.
Client Installation Steps (General Overview):
- Client receives secure installation package via encrypted channel
- Package includes:
- Client key ID and public key hash
- Connection endpoint (your AEGIS platform URL)
- Algorithm and security level configuration
- Integration library (language-specific SDK)
- Client integrates the library into their application
- Configuration:
- Set endpoint URL
- Load client key credentials
- Enable TLS-1.3-PQ or IPSec-PQ protocol
- Verify hybrid mode settings
- Test connection using provided verification tool
- Monitor connection status in their dashboard
Note: Specific implementation details are provided to authorized clients only. The installation process varies by protocol and client environment.
Why Rotate Keys?
Regular key rotation reduces the impact of potential compromises and maintains cryptographic hygiene. NIST recommends rotating encryption keys every 12-24 months.
Key Rotation Process:
- System sends automated alerts 30 days before key expiration
- Generate new keys (same or upgraded algorithm)
- Transition period:
- Old keys remain valid for 14 days
- New keys are deployed simultaneously
- Connections automatically negotiate to new keys
- After transition, old keys are marked as "deprecated"
- Revoke old keys after confirming all connections migrated
- Audit logs track the entire rotation process
Key Status Lifecycle:
What Is Audited?
Every cryptographic operation is logged for compliance, forensics, and security monitoring. The audit log captures key generation, rotations, connection events, and signature verifications.
Using the Audit Log:
- Navigate to the "Audit Log" tab
- Filter by:
- Event type (key generation, connection, handshake, etc.)
- Status (success, failure, warning)
- Key ID or connection ID
- Date range
- Review failed events for security incidents
- Export logs for compliance reporting (FIPS 140-3, CNSA 2.0)
- Set up automated alerts for suspicious activity
Compliance Features:
- Tamper-evident logs with cryptographic integrity checks
- Immutable audit trail for forensic analysis
- Automated compliance verification reports
- Integration with SIEM systems for enterprise monitoring
PQE is an enterprise add-on service. To enable quantum-resistant encryption for your AEGIS/DTM deployment:
- Contact your AEGIS platform administrator or account manager
- Review the PQE service agreement and security requirements
- Complete initial setup with technical support
- Begin with organizational key generation (Step 1 above)