QuantumVault Documentation

Enterprise-grade post-quantum cryptography platform providing NIST-certified algorithms for quantum-resistant encryption, digital signatures, and secure key management.

Why Post-Quantum Cryptography?

Quantum computers pose an existential threat to current cryptographic systems. RSA, ECC, and other widely-used algorithms can be broken by Shor's algorithm running on a sufficiently powerful quantum computer. The NSA and NIST have mandated a transition to quantum-resistant cryptography by 2035, with critical systems required to migrate by 2030.

Supported Algorithms

Pricing Tiers

Quick Start Guide

Get up and running with QuantumVault in under 5 minutes. This guide covers API key generation, your first encryption operation, and basic key management.

Step 1: Get Your API Key

After signing up at quantumvault.allsecurex.com, your API key is automatically generated. You can view it in the API Keys section of your dashboard.

Step 2: Generate a Key Pair

curl -X POST https://api.quantumvault.allsecurex.com/keygen \
  -H "Content-Type: application/json" \
  -H "X-API-Key: qv_your_api_key_here" \
  -d '{
    "algorithm": "ML-KEM-768",
    "security_level": 3,
    "name": "my-first-key"
  }'

Step 3: Encrypt Data

# First, base64 encode your plaintext
PLAINTEXT=$(echo -n "Hello, Quantum World!" | base64)

curl -X POST https://api.quantumvault.allsecurex.com/encrypt \
  -H "Content-Type: application/json" \
  -H "X-API-Key: qv_your_api_key_here" \
  -d '{
    "algorithm": "ML-KEM-768",
    "public_key": "<public_key_from_keygen>",
    "plaintext": "'$PLAINTEXT'"
  }'

Step 4: Decrypt Data

curl -X POST https://api.quantumvault.allsecurex.com/decrypt \
  -H "Content-Type: application/json" \
  -H "X-API-Key: qv_your_api_key_here" \
  -d '{
    "algorithm": "ML-KEM-768",
    "secret_key": "<secret_key_from_keygen>",
    "encrypted_data": "<encrypted_data_from_encrypt>"
  }'

# Response plaintext is base64 encoded - decode it:
# echo "<plaintext>" | base64 -d

Authentication

QuantumVault uses API key authentication for all cryptographic operations. Each request must include a valid API key in the X-API-Key header.

API Key Format

API keys follow the format qv_ followed by 32 cryptographically random characters.

X-API-Key: qv_k7x9mN2pQ4rS6tU8vW0yA3bC5dE7fG9h

Security Best Practices

• Store API keys in environment variables or secret managers (AWS Secrets Manager, HashiCorp Vault)
• Never commit API keys to version control
• Use different API keys for development, staging, and production environments
• Rotate API keys every 90 days
• Monitor usage for anomalies in the dashboard
• Revoke compromised keys immediately

Rate Limits

Rate limit headers are included in every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

SDKs & Integration

QuantumVault provides official SDKs for Node.js, Python, Go, and Java. These SDKs offer drop-in quantum-safe cryptography with zero code changes required for your existing applications.

Available SDKs

Node.js SDK

@allsecurex-quantum/crypto-shim

Drop-in quantum-safe upgrade for Node.js applications. Zero code changes required - automatically upgrades RSA, ECDSA, and ECDH operations to ML-KEM and ML-DSA hybrids.

Installation

npm install @allsecurex-quantum/crypto-shim

Quick Start

// IMPORTANT: This must be the VERY FIRST line of your application
require('@allsecurex-quantum/crypto-shim').install({
  apiKey: process.env.QUANTUMVAULT_API_KEY,
  mode: 'hybrid', // 'monitor' | 'hybrid' | 'pq_only'
  logging: {
    enabled: true,
    level: 'info'
  }
});

// Now use crypto as normal - it's quantum-safe!
const crypto = require('crypto');

// Your existing code works unchanged!
// RSA signatures → automatically upgraded to ML-DSA-65 hybrid
const sign = crypto.createSign('RSA-SHA256');
sign.update('data to sign');
const signature = sign.sign(privateKey);

// ECDH key exchange → automatically upgraded to ML-KEM-768 hybrid
const ecdh = crypto.createECDH('prime256v1');
const publicKey = ecdh.generateKeys();

Python SDK

quantumvault-cryptography

Drop-in quantum-safe upgrade for Python applications. Works with existing cryptography library usage - all crypto operations are upgraded transparently.

Installation

pip install quantumvault-cryptography

Quick Start

# IMPORTANT: Must be called BEFORE importing cryptography
import os
import quantumvault_cryptography

quantumvault_cryptography.install(
    api_key=os.environ['QUANTUMVAULT_API_KEY'],
    mode='hybrid'  # 'monitor' | 'hybrid' | 'pq_only'
)

# Now import and use cryptography as normal
from cryptography.hazmat.primitives.asymmetric import rsa, ec

# Your existing code works unchanged!
# RSA key generation → automatically includes ML-KEM-768
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048
)

# ECDSA signing → automatically includes ML-DSA hybrid
ec_key = ec.generate_private_key(ec.SECP256R1())

Go SDK

github.com/AllSecureX-Quantum/quantumvault-go

Native post-quantum cryptography SDK for Go. Implements ML-KEM (FIPS 203) and ML-DSA (FIPS 204) with full support for Go's crypto.Signer interface.

Installation

go get github.com/AllSecureX-Quantum/quantumvault-go

ML-KEM Key Encapsulation (FIPS 203)

package main

import (
    "fmt"
    qv "github.com/AllSecureX-Quantum/quantumvault-go"
)

func main() {
    // Security levels: MLKEM512, MLKEM768 (recommended), MLKEM1024
    pub, priv, err := qv.GenerateMLKEMKeyPair(qv.MLKEM768)
    if err != nil {
        panic(err)
    }

    // Encapsulate - generates ciphertext and shared secret
    ciphertext, sharedSecret1, err := qv.Encapsulate(pub)
    if err != nil {
        panic(err)
    }

    // Decapsulate - recovers the same shared secret
    sharedSecret2, err := qv.Decapsulate(priv, ciphertext)
    if err != nil {
        panic(err)
    }

    fmt.Printf("Shared secrets match: %v\n",
        string(sharedSecret1) == string(sharedSecret2))
}

ML-KEM (Key Encapsulation)

NIST FIPS 203 | Formerly CRYSTALS-Kyber

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is NIST's primary post-quantum encryption standard. It provides secure key exchange resistant to quantum computer attacks while maintaining excellent performance.

Available Parameter Sets

ML-DSA (Digital Signatures)

NIST FIPS 204 | Formerly CRYSTALS-Dilithium

ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is NIST's primary post-quantum digital signature standard. It enables quantum-resistant authentication, non-repudiation, and data integrity verification.

Available Parameter Sets

Use Cases

• Code Signing - Verify software authenticity and integrity
• Document Signing - Legal contracts, certificates, compliance documents
• API Authentication - Request signing for API security
• Blockchain - Quantum-resistant transaction signatures
• PKI Certificates - X.509 certificate signatures

Key Generation

Generate quantum-safe cryptographic key pairs for encryption (ML-KEM) or digital signatures (ML-DSA, SLH-DSA).

curl -X POST https://api.quantumvault.allsecurex.com/keygen \
  -H "Content-Type: application/json" \
  -H "X-API-Key: qv_your_api_key" \
  -d '{
    "algorithm": "ML-KEM-768",
    "security_level": 3,
    "name": "production-encryption-key",
    "description": "Primary encryption key for customer data"
  }'

{
  "key_id": "qv_key_7f3e8c2a-b1d4-4e5f-9a6c-8d7e2f1b3a4c",
  "name": "production-encryption-key",
  "algorithm": "ML-KEM-768",
  "security_level": 3,
  "public_key": "MIIBojANBgkqhki...base64_encoded...",
  "secret_key": "MIIEvgIBADANBgk...base64_encoded...",
  "stored": true,
  "created_at": "2025-01-26T10:30:00.000Z"
}

Encryption

Encrypt data using ML-KEM key encapsulation. The plaintext is encrypted with a symmetric key derived from the KEM shared secret.

const crypto = require('crypto');

// Your sensitive data
const plaintext = JSON.stringify({
  ssn: '123-45-6789',
  accountNumber: '9876543210'
});

// Base64 encode the plaintext
const encodedPlaintext = Buffer.from(plaintext).toString('base64');

const response = await fetch('https://api.quantumvault.allsecurex.com/encrypt', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': process.env.QUANTUMVAULT_API_KEY
  },
  body: JSON.stringify({
    algorithm: 'ML-KEM-768',
    public_key: recipientPublicKey,
    plaintext: encodedPlaintext
  })
});

const result = await response.json();
console.log('Encrypted:', result.encrypted_data);

Digital Signatures

Create quantum-safe digital signatures using ML-DSA or SLH-DSA algorithms. Signatures provide authentication, integrity, and non-repudiation.

import requests
import base64

API_KEY = "qv_your_api_key"
BASE_URL = "https://api.quantumvault.allsecurex.com"

# Sign a message
message = base64.b64encode(b"Document content to sign").decode()
sign_response = requests.post(
    f"{BASE_URL}/sign",
    headers={"X-API-Key": API_KEY},
    json={
        "algorithm": "ML-DSA-65",
        "signing_key": signing_private_key,
        "message": message
    }
)
signature = sign_response.json()["signature"]

# Verify the signature
verify_response = requests.post(
    f"{BASE_URL}/verify",
    headers={"X-API-Key": API_KEY},
    json={
        "algorithm": "ML-DSA-65",
        "verifying_key": signing_public_key,
        "message": message,
        "signature": signature
    }
)
is_valid = verify_response.json()["valid"]  # True if signature is valid

Error Handling

QuantumVault uses standard HTTP status codes and returns detailed error information to help you diagnose and handle issues.

Error Response Format

{
  "error": {
    "code": "INVALID_ALGORITHM",
    "message": "Algorithm 'AES-256' is not supported for this operation."
  }
}

Error Codes

Financial Services

Quantum-Safe Cryptography for Banks, Investment Firms & Insurance

Financial institutions handle some of the most sensitive data in the world. With quantum computers threatening to break current encryption, the financial sector faces unique challenges in protecting customer assets, transaction integrity, and regulatory compliance.

Healthcare

Protecting Patient Data with Quantum-Resistant Cryptography

Healthcare organizations manage protected health information (PHI) that must remain confidential for decades. Patient records, genomic data, and medical research require the strongest possible encryption to meet HIPAA requirements and protect patient privacy.

Defense & Government

CNSA 2.0 Compliant Cryptography for National Security

Government and defense organizations have the strictest security requirements. The NSA's CNSA 2.0 (Commercial National Security Algorithm Suite) mandates quantum-resistant cryptography for all National Security Systems by 2030.

NIST FIPS Standards

QuantumVault implements algorithms from NIST's Post-Quantum Cryptography Standardization process, finalized in August 2024. These are the first quantum-resistant cryptographic standards approved for federal use.

Compliance Frameworks

QuantumVault is designed to help organizations meet various regulatory and industry compliance requirements with quantum-safe cryptography.

Post-Quantum Cryptography

Post-Quantum Cryptography (PQC) refers to cryptographic algorithms designed to be secure against attacks from quantum computers. Unlike classical computers, quantum computers can efficiently solve certain mathematical problems that form the basis of current encryption.

The Quantum Threat

Mathematical Foundations

QuantumVault's algorithms are built on mathematical problems believed to be hard for both classical and quantum computers:

Security Levels

NIST defines security levels based on the computational effort required to break an algorithm. QuantumVault supports all levels, allowing you to choose the appropriate security for your use case.

SLH-DSA (Hash-Based Signatures)

NIST FIPS 205 | Formerly SPHINCS+

SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) provides maximum long-term security by relying solely on the security of hash functions. Unlike lattice-based schemes, its security is well-understood and conservative.

Parameter Sets

SLH-DSA vs ML-DSA

Decryption

Decrypt data that was encrypted using ML-KEM. Requires the corresponding secret key.

Endpoint

Request Body

Example

import requests
import base64

response = requests.post(
    'https://api.quantumvault.allsecurex.com/decrypt',
    headers={'X-API-Key': api_key},
    json={
        'algorithm': 'ML-KEM-768',
        'secret_key': secret_key,
        'encrypted_data': encrypted_data
    }
)

result = response.json()
plaintext = base64.b64decode(result['plaintext']).decode('utf-8')
print(f"Decrypted: {plaintext}")

Response

{
  "plaintext": "eyJzc24iOiIxMjMtNDUtNjc4OSIsImFjY291bnROdW1iZXIiOiI5ODc2NTQzMjEwIn0="
}

Note: The plaintext is base64 encoded. Decode it to get the original data.

Signature Verification

Verify digital signatures to confirm authenticity and integrity of signed data.

Endpoint

Request Body

Example

async function verifySignature(
  message: string,
  signature: string,
  publicKey: string
): Promise<boolean> {
  const response = await fetch('https://api.quantumvault.allsecurex.com/verify', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-API-Key': process.env.QUANTUMVAULT_API_KEY!
    },
    body: JSON.stringify({
      algorithm: 'ML-DSA-65',
      verifying_key: publicKey,
      message: message,
      signature: signature
    })
  });

  const result = await response.json();
  return result.valid;
}

// Usage
const isValid = await verifySignature(messageB64, signature, signerPublicKey);
if (isValid) {
  console.log('Signature verified - document is authentic');
} else {
  console.error('SIGNATURE INVALID - document may be tampered');
}

Response

{
  "valid": true
}

Key Management

QuantumVault provides secure cloud-based key storage and management. All keys are encrypted at rest using AES-256 and are only accessible via your API key.

List Keys

curl -X GET https://api.quantumvault.allsecurex.com/keys \
  -H "X-API-Key: qv_your_api_key"

Get Key Details

Delete Key

Java SDK

io.quantumvault:quantumvault-crypto (JCA Provider)

JCA Provider for post-quantum cryptography. Integrates with standard Java Security API - use KeyPairGenerator, Cipher, and Signature as usual.

Installation

<dependency>
    <groupId>io.quantumvault</groupId>
    <artifactId>quantumvault-crypto</artifactId>
    <version>1.0.0</version>
</dependency>

Quick Start

import java.security.*;
import io.quantumvault.crypto.QuantumVaultProvider;

public class Example {
    public static void main(String[] args) throws Exception {
        // Register the JCA provider
        Security.addProvider(new QuantumVaultProvider());

        // Generate ML-KEM key pair (FIPS 203)
        KeyPairGenerator kpg = KeyPairGenerator.getInstance("ML-KEM-768", "QuantumVault");
        KeyPair kemKeyPair = kpg.generateKeyPair();
        System.out.println("Generated ML-KEM-768 key pair!");

        // Generate ML-DSA key pair (FIPS 204)
        KeyPairGenerator sigKpg = KeyPairGenerator.getInstance("ML-DSA-65", "QuantumVault");
        KeyPair sigKeyPair = sigKpg.generateKeyPair();

        // Sign message
        Signature sig = Signature.getInstance("ML-DSA-65", "QuantumVault");
        sig.initSign(sigKeyPair.getPrivate());
        sig.update("Hello, Quantum World!".getBytes());
        byte[] signature = sig.sign();

        // Verify signature
        sig.initVerify(sigKeyPair.getPublic());
        sig.update("Hello, Quantum World!".getBytes());
        boolean valid = sig.verify(signature);
        System.out.println("Signature valid: " + valid);
    }
}

REST API

Direct HTTP API for any language or platform. Use this when an SDK isn't available for your language, or when you need fine-grained control over cryptographic operations.

Base URL

https://api.quantumvault.allsecurex.com

Authentication

Content-Type: application/json
X-API-Key: qv_your_api_key_here

Endpoints Summary

Enterprise Software

Quantum-Ready Applications for Modern Enterprises

Modern enterprises face increasing cyber threats while managing sensitive customer data, intellectual property, and business secrets. QuantumVault provides the cryptographic foundation for building quantum-ready applications.

Integration Patterns

// Per-tenant encryption
const tenantKey = await qv.keygen({
  algorithm: 'ML-KEM-768',
  name: `tenant-${tenantId}-key`
});
const encrypted = await qv.encrypt({
  publicKey: tenantKey.public_key,
  plaintext: customerData
});

// Request signing
const signature = await qv.sign({
  algorithm: 'ML-DSA-65',
  signingKey: apiPrivateKey,
  message: JSON.stringify(requestBody)
});
headers['X-Signature'] = signature;

Security Best Practices

Follow these guidelines to maximize the security of your QuantumVault implementation.

Key Management Best Practices

Proper key management is critical for maintaining cryptographic security.

Key Lifecycle

Rotation Recommendations

Integration Patterns

Common patterns for integrating QuantumVault into your applications.

Best Practices for Integration

Enterprise Features

Production-ready post-quantum cryptography for enterprise deployments. QuantumVault Enterprise provides advanced features for organizations requiring seamless migration to quantum-safe cryptography without disrupting existing systems.

Why Enterprise?

Crypto Plugins

Drop-in quantum-safe upgrades for existing applications. Zero code changes required.

Supported Platforms

Algorithm Mappings

Hybrid Encryption

Classical + Post-Quantum cryptography for defense-in-depth during the quantum transition period.

What is Hybrid Encryption?

Hybrid encryption combines classical cryptographic algorithms (RSA, ECDH, ECDSA) with post-quantum algorithms (ML-KEM, ML-DSA) to provide security against both classical and quantum attacks. This "belt and suspenders" approach ensures that even if one algorithm is broken, the other continues to provide protection.

Key Types

Automated Key Rotation

Enterprise-grade key lifecycle management with automated rotation policies.

Create Rotation Policy

curl -X POST https://api.quantumvault.allsecurex.com/keys/rotation-policies \
  -H "X-API-Key: qv_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Key Rotation",
    "rotation_interval_days": 90,
    "algorithm": "ML-KEM-1024",
    "auto_rotate": true,
    "notify_before_days": 7,
    "notification_emails": ["security@company.com"],
    "retention_versions": 3
  }'

Rotation Best Practices

Compliance Reporting

Generate comprehensive compliance reports demonstrating your organization's quantum-readiness and adherence to cryptographic standards.

Generate Report

curl -X POST https://api.quantumvault.allsecurex.com/compliance/reports \
  -H "X-API-Key: qv_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "report_type": "cnsa_2_0",
    "period_start": "2026-01-01",
    "period_end": "2026-01-31",
    "include_sections": [
      "algorithm_usage",
      "key_rotation_compliance",
      "quantum_risk_assessment",
      "remediation_recommendations"
    ]
  }'

Migration Guide

Step-by-step guide to quantum-safe migration. Migrating to post-quantum cryptography doesn't have to be disruptive.

Migration Phases

Zero-Code Migration

Migrate to quantum-safe crypto without changing application code.

Step-by-Step Guide

# Python
pip install quantumvault-cryptography

# Node.js
npm install @allsecurex-quantum/crypto-shim

# Java (Maven)
<dependency>
  <groupId>io.quantumvault</groupId>
  <artifactId>jca-provider</artifactId>
  <version>1.0.0</version>
</dependency>

# Add at the VERY TOP of your main file
import quantumvault_cryptography
quantumvault_cryptography.install(
    api_key=os.environ['QUANTUMVAULT_API_KEY'],
    mode='hybrid'
)

# That's it! All crypto operations are now quantum-safe.
# Your existing code works unchanged.

Gradual Rollout Strategy

Safely deploy quantum-safe crypto across your infrastructure with percentage-based rollouts.

Rollout Configuration

import quantumvault_cryptography

# Start with 10% of operations being upgraded
quantumvault_cryptography.install(
    api_key=os.environ['QUANTUMVAULT_API_KEY'],
    mode='hybrid',
    rollout={
        'percentage': 10,           # Only 10% of operations upgraded
        'sticky_sessions': True,    # Same user gets consistent behavior
        'exclude_paths': [          # Exclude critical paths initially
            '/api/payments/*',
            '/api/auth/*'
        ]
    }
)

# After validation, increase to 50%
# quantumvault_cryptography.set_rollout_percentage(50)

# Finally, 100% rollout
# quantumvault_cryptography.set_rollout_percentage(100)

Rollout Checklist

Testing Strategies

Validate quantum-safe migration before production deployment.

# Test that encryption/decryption works with hybrid mode
def test_hybrid_encryption():
    quantumvault_cryptography.install(api_key=TEST_KEY, mode='hybrid')

    plaintext = b"test message"
    ciphertext = encrypt(plaintext)
    decrypted = decrypt(ciphertext)

    assert decrypted == plaintext
    assert quantumvault_cryptography.status()['upgraded_operations'] > 0

# Test API endpoints work with hybrid crypto
def test_api_with_hybrid_crypto():
    # Enable hybrid mode for tests
    response = client.post('/api/secure-data', json={'data': 'sensitive'})
    assert response.status_code == 200

    # Verify data can be retrieved
    response = client.get('/api/secure-data/123')
    assert response.json()['data'] == 'sensitive'