Public-key cryptography underpins every secure connection on the internet. Quantum computers will break it. The migration to post-quantum algorithms is not optional, and waiting for quantum hardware to arrive is already too late. Data stolen today can be decrypted tomorrow.
Every RSA key, every elliptic-curve signature, every Diffie-Hellman key exchange deployed today rests on mathematical problems that a sufficiently large quantum computer will solve in polynomial time. Shor's algorithm reduces integer factorization and discrete logarithm problems from computationally infeasible to trivially solvable.
The threat is not limited to the future. Nation-state adversaries are executing "harvest now, decrypt later" campaigns: intercepting and storing encrypted traffic today with the expectation that quantum computers will decrypt it within years. Sensitive data with a long secrecy lifetime, including classified intelligence, medical records, financial transactions, and infrastructure control signals, is already at risk.
This means the migration window is now, not when cryptographically relevant quantum computers arrive. Organizations that wait will find themselves retrofitting cryptographic infrastructure under pressure, with adversaries already holding their archived ciphertext.
Harvest now, decrypt later. Encrypted data exfiltrated today can be stored indefinitely and decrypted once a cryptographically relevant quantum computer is operational. Data with a secrecy requirement beyond 2030 should be treated as exposed if protected only by RSA or ECC.
Migration takes years. Cryptographic transitions historically require a decade or more. The AES migration began in 2001 and some systems still run DES. Organizations cannot afford to start late.
In August 2024, NIST published the first three post-quantum cryptography standards after an eight-year evaluation. These algorithms replace RSA, ECDSA, and ECDH for key encapsulation and digital signatures. Federal agencies, defense contractors, and regulated financial institutions face near-term compliance deadlines.
Module-Lattice-Based Key-Encapsulation Mechanism. The primary standard for key establishment, replacing RSA key transport and ECDH key agreement. Based on the CRYSTALS-Kyber submission. Three parameter sets: ML-KEM-512, ML-KEM-768, ML-KEM-1024.
Module-Lattice-Based Digital Signature Algorithm. The primary standard for digital signatures, replacing RSA signatures and ECDSA. Based on the CRYSTALS-Dilithium submission. Three security levels: ML-DSA-44, ML-DSA-65, ML-DSA-87.
Stateless Hash-Based Digital Signature Algorithm. A conservative, hash-based signature scheme offering a different mathematical foundation from lattice-based schemes. Based on SPHINCS+. Twelve parameter sets across SHA-256 and SHAKE variants.
CNSA 2.0 Timeline. NSA's Commercial National Security Algorithm Suite 2.0 mandates ML-KEM and ML-DSA for national security systems. Software and firmware implementations required by 2025. Hardware and embedded systems by 2030. Full transition by 2035. Non-compliance blocks procurement.
Dyber provides all three NIST PQC standards as verified, foundry-portable semiconductor IP. But a secure product needs more than PQC algorithms. It needs symmetric encryption, hashing, entropy, key management, side-channel protection, and integration infrastructure. Dyber delivers the complete stack.
ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) as synthesizable SystemVerilog RTL. All parameter sets. Byte-exact against NIST ACVP test vectors. Self-checking testbenches and Python golden-reference models included.
AES-256 in ECB, CTR, and GCM modes. SHA-256, SHA-512, SHA3-256, SHA3-512, SHAKE-128, SHAKE-256. The symmetric and hash primitives every PQC algorithm and secure protocol requires internally.
True random number generators with conditioning and health monitoring. DRBG cores compliant with NIST SP 800-90A. Entropy is the foundation of all cryptographic security. Without good randomness, nothing else matters.
X-Wing KEM combining ML-KEM-768 with X25519 in a single combiner. Composite signature schemes binding ML-DSA to ECDSA. Crypto-agile designs that remain secure if either the classical or PQC component holds.
NTT engines, Keccak permutation cores, polynomial arithmetic units, modular reduction. The shared math primitives that PQC accelerators reuse across algorithms, enabling area-optimized multi-algorithm designs.
APB, AHB-Lite, and AXI4-Lite bus wrappers. FIFO-based streaming interfaces. Side-channel countermeasures including masking and constant-time execution. The glue logic that connects cryptographic cores to your SoC.
Soft IP, foundry-portable. All cores are delivered as synthesizable SystemVerilog RTL with self-checking testbenches, Python golden-reference models, cocotb regressions, synthesis scripts, and integration guides. Runs on any process node. Firm and hard IP available on engagement.
The cryptographic community agrees: deploy PQC alongside classical algorithms during the transition period. Hybrid combiners ensure that the system remains secure as long as either the classical or the post-quantum component holds. This is the safe path. CNSA 2.0 and major protocol standards (TLS 1.3, IKEv2, X.509) already define hybrid modes.
Combines ML-KEM-768 with X25519 in a single key encapsulation mechanism. If either the lattice-based or elliptic-curve component is secure, the combined key is secure. Defined in draft-connolly-cfrg-xwing-kem. Designed for TLS 1.3 and other transport protocols.
Binds an ML-DSA signature with an ECDSA signature into a single composite. Both signatures must verify for the composite to be valid. Provides backward compatibility with existing PKI while adding quantum resistance. Follows IETF composite signature specifications.
Crypto-agility by design. Dyber's hybrid cores are built to be replaced. When confidence in PQC algorithms matures and hybrid requirements are lifted, the classical component can be removed without redesigning the integration. Plan for the transition, not just the destination.
Every Dyber cryptographic core is verified against the same NIST Automated Cryptographic Validation Protocol (ACVP) test vectors that certification laboratories use. This is not functional simulation. It is not "encrypt then decrypt and check the plaintext matches." It is deterministic, vector-by-vector comparison of intermediate values and final outputs against the official NIST reference.
Self-checking testbenches run the full ACVP vector set on every regression. Python golden-reference models provide an independent, software-based oracle for comparison. Cocotb-based test infrastructure enables rapid integration into customer verification flows.
Verification is not certification. ACVP vector verification confirms algorithmic correctness of the RTL. It does not constitute a CAVP certificate or FIPS 140-3 validation. Dyber's verification methodology supports and accelerates the path to formal certification, but the certification itself is performed by an accredited lab on the customer's end product.
Verified, foundry-portable semiconductor IP for the post-quantum transition. All three NIST standards, plus the symmetric, entropy, and integration IP a real product needs.