Post-Quantum Cryptography Overview

BrainstormRouter's post-quantum readiness architecture

Post-Quantum Cryptography Overview

BrainstormRouter is post-quantum ready — the first AI gateway with cryptographic agility and hybrid PQC support.

Why PQC Matters for AI Gateways

AI gateways process sensitive data: API keys, model prompts, audit trails, agent credentials. The "Harvest Now, Decrypt Later" (HNDL) threat means adversaries can capture encrypted traffic today and decrypt it once quantum computers are available. AI gateways are high-value HNDL targets because:

• API keys grant access to expensive model providers
• Audit trails contain business-sensitive prompt/response data
• Agent certificates authenticate autonomous systems
• Memory stores hold persistent user information

Architecture

Cryptographic Agility Layer

The crypto-agility.ts module provides config-driven algorithm selection:

// Resolve the best available algorithm for each family
const keyExchange = resolveAlgorithm("key-exchange", config.crypto?.keyExchange);
const signature = resolveAlgorithm("signature", config.crypto?.signature);
const hash = resolveAlgorithm("hash", config.crypto?.hash);

Algorithm Support

Family	Classical	Post-Quantum	Hybrid
Key Exchange	X25519	ML-KEM-768	X25519+ML-KEM-768
Signature	Ed25519, RSA-PSS, HMAC-SHA256	ML-DSA-65	Classical + ML-DSA-65
Hash	SHA-256, SHA-512	SHA-3-256	—

Hybrid TLS

On OpenSSL 3.5+, the gateway negotiates hybrid X25519+ML-KEM-768 key exchange. Clients that support PQC get quantum-resistant key exchange; classical clients fall back to X25519 automatically.

Dual Signatures (Audit Trail)

Audit entries are dual-signed: HMAC-SHA256 (backward compatibility) + ML-DSA-65 (forward security). The classical signature ensures existing verification tools work; the PQC signature provides quantum-resistant integrity.

Deployment

Prerequisites

• OpenSSL 3.5+ for hybrid TLS (Node.js 22+ ships with OpenSSL 3.x)
• liboqs-node for ML-DSA-65 signatures (optional — falls back to classical-only)

Configuration

{
  "security": {
    "crypto": {
      "keyExchange": "hybrid-pqc",
      "signature": "ml-dsa-65",
      "hash": "sha256"
    }
  }
}

Verification

# Check if PQC TLS is active
openssl s_client -connect api.brainstormrouter.com:443 -groups X25519MLKEM768

# Verify dual-signed audit entry
curl -H "Authorization: Bearer $KEY" \
  https://api.brainstormrouter.com/v1/governance/audit/chain/verify