Post-quantum keys with minimal time-to-live
Automatic rotation on critical endpoints. Kills the "harvest-now, decrypt-later" risk at the root.
Why TTL is the game-changer
Attackers are already capturing today’s traffic to decrypt with a future quantum computer. If your session key lives for months, every captured packet falls under a single key. With TTL-PQC, a compromise only exposes the last 30 seconds of data.
Minimum exposure window
At TTL 30 s, a harvest attack only captures the last 30 seconds before rotation. Blast radius cut by 99.99%.
CNSA 2.0 resistance
Hybrid Kyber768 + X25519 — safe against Shor (PQ) and classical ECDLP. Compliant with CNSA 2.0 through 2030.
Zero operational downtime
Atomic rotation: 1 extra RTT per cycle, no TCP session restart.
How it works under the hood
5 critical steps executed on every rotation cycle, with zero manual intervention.
Initial session
Client + server derive a session key via hybrid Kyber768 + X25519 handshake (CNSA 2.0).
TTL timer
A monotonic timer fires rotation at the configured TTL (30 s–24 h). Does not rely on wall clock.
Atomic re-encapsulation
New Kyber + X25519 encapsulation lands in an atomic transaction: no downtime, no packet loss, no retransmissions.
Ed25519 audit trail
Each rotation produces one JSON event { epoch, sha3(key), ts } Ed25519-signed — exported in real time to your SIEM.
Old key zeroize
After the 30 s grace window, the previous key is overwritten in memory (zeroize) and never persisted.
Watch rotation in action
Simulate the TTL-PQC rotation cycle. Adjust the TTL and watch keys being atomically replaced, with real-time Ed25519 audit trail.
TTL configurable per use-case
Four standard values — or choose any intermediate value via SDK / API.
High-value payments, SWIFT, HFT trading
Corporate APIs, webhooks, microservices
Customer portals, dashboards, BI
Fleet IoT batch, backups, daily ETL
Where TTL-PQC is the obvious pick
Three verticals where regulators already demand frequent key rotation.
Banking & Payments
SWIFT CSP and PCI-DSS require frequent key rotation. TTL-PQC rotates Kyber768+X25519 every 30 s on critical sockets, leaving zero window for an attacker to accumulate usable ciphertexts by 2030.
Telecom & 5G Core
GSMA FS.31 already flags N2/N3 and roaming interconnect as the #1 “harvest-now” target. TTL-PQC runs near the UPF, with routes rendered cryptographically invalid every 5 min.
Government & Defence
ANSSI, BSI and NATO C-M(2002)49 mandate proof of periodic key rotation for classified comms. The Ed25519-sealed audit trail of TTL-PQC logs every cycle with timestamp + SHA3 of the key itself.
TTL-PQC vs static keys
Six critical differences the auditor will check in 2026.
| Feature | TTL-PQC | Static PQ keys |
|---|---|---|
| “Harvest-now” window | 30 s – 24 h (configurable) | Months / years (static key) |
| NIST PQC algorithms | Kyber768 + X25519 + ML-DSA | X25519 / RSA / ECC only |
| Zero-downtime rotation | Sim (atómica) | No (restarts handshake) |
| Crypto-sealed audit trail | Ed25519 por rotação | Depends on TLS log |
| SWIFT CSP / DORA compliance | Native rotation proof | Requires external process |
| Operational complexity | Drop-in SDK (5 lines) | Custom key rotation scripts |