Embedded Software Engineer

Quantum-Proof VPP: bringing post-quantum security to the data plane. 11/05/2026. The quantum computing era is not a distant theoretical concern - it is an engineering reality that network architects and security teams need to address as soon as possible. At the intersection of high-performance, open-source networking and cutting-edge post-quantum cryptography, experts from PANTHEON.tech and Qrypt have joined forces. This post introduces its Quantum-Proof VPP (QP-VPP) project, a proof-of-concept that leverages PANTHEON.tech's expertise in the FD.io VPP data plane to integrate Qrypt's BLAST protocol - a quantum-safe key exchange solution - via WireGuard, ensuring cryptographic resilience for the data plane. [The problem] asymmetric encryption in the post-quantum era. Today's VPN and secure-tunnel solutions (including WireGuard) rely on asymmetric cryptography for key exchange. Algorithms such as Diffie-Hellman (DH) and elliptic-curve variants (ECDH) are mathematically hard problems that classical computers cannot crack in a practical timeframe. A sufficiently powerful quantum computer running Shor's algorithm could solve these problems efficiently. This is not just a problem for the future - it is a problem right now, thanks to a threat model known as "Harvest Now, Decrypt Later" (HNDL). Bad actors capture encrypted traffic today, store it, and decrypt it once quantum hardware matures. For any sensitive communication - government, finance, telco - this is an unacceptable risk. How WireGuard addresses quantum resistance. WireGuard is a modern VPN protocol praised for its simplicity, performance, and strong cryptographic defaults. Unlike older protocols like IPsec or OpenVPN, WireGuard was designed with a minimal attack surface in mind. WireGuard's designers were aware of the quantum threat and included a mechanism specifically to address it: the Pre-Shared Key (PSK). When a PSK is configured between two WireGuard peers, it is mixed into the handshake key derivation using a symmetric key-based construction. Symmetric cryptography (like AES-256, used for the PSK) is quantum-resistant in a practical sense. Grover's algorithm on a quantum computer only reduces its effective key strength by half, leaving a 256-bit key with 128 effective bits of quantum security, which remains computationally infeasible to break. But there is a catch, as always. The PSK distribution problem: why symmetric keys are hard to share. A quantum-proof tunnel is only as strong as the method used to distribute its pre-shared key. QP-VPP provides an alternative to traditional PQC key-encapsulation mechanisms (KEMs) by leveraging Qrypt's quantum-derived entropy for PSK synchronization, avoiding the computational overhead of some software-based PQC algorithms. The PSK must be identical on both endpoints of a WireGuard tunnel. This sounds simple, but it introduces the very problem that asymmetric cryptography was invented to solve: how do you securely share a secret between two parties, over an untrusted network, without an attacker intercepting it? If you distribute the PSK using a classical asymmetric channel - for example, TLS-encrypted configuration management - you have re-introduced the quantum vulnerability through the back door. An adversary using HNDL can intercept the PSK distribution and decrypt it later. You have solved nothing. Manual PSK distribution (e.g., out-of-band USB delivery, printed key material) is operationally impractical at scale and does not support automated key rotation. For network infrastructure that needs to rotate keys frequently - a strong security practice - this approach simply does not work. The solution: quantum-safe Key Synchronization via Qrypt BLAST protocol. The key insight is that distributing a symmetric key securely requires a fundamentally different approach than classical public-key cryptography. This is where quantum entropy and the Qrypt BLAST protocol enter the picture. Qrypt provides a Quantum Key Distribution (QKD)-inspired service built on quantum random number generation (QRNG). Instead of computing a shared secret mathematically, both endpoints independently derive identical key material from a quorum of multiple independent Digital Quantum Key Distribution (DQKD) servers. The BLAST (Broadband Lightweight Asynchronous Synchronization Technology) protocol is Qrypt's mechanism for synchronizing this entropy between endpoints: * One endpoint acts as the initiator and generates an AES key along with cryptographic metadata. * The metadata (not the key itself) is shared with the peer endpoint - this metadata is safe to transmit, even over a potentially compromised channel. * The BLAST protocol synchronizes key material by transmitting cryptographic metadata rather than the raw PSK, ensuring that the key is only reconstructed within the secure boundaries of the SDK, on each endpoint. * A configurable Time-To-Live (TTL) limits how long the metadata remains valid, enabling automatic key rotation without re-transmitting secrets. This design ensures that the raw PSK is never exposed on the data plane. Instead, the BLAST protocol uses metadata to synchronize key derivation between endpoints using out-of-band quantum entropy. For an attacker, this effectively neutralizes HNDL threats, even if the metadata is intercepted today, the key cannot be reconstructed without simultaneous, unauthorized access to the secure quantum entropy stream. QP-VPP demo description. The QP-VPP demo validates the end-to-end operation of a quantum-proof VPN tunnel, within the high-performance FD.io VPP data plane. * Quantum Key Synchronization: Two containerized VPP WireGuard endpoints (an initiator and a synchronizer) independently derive an identical symmetric Pre-Shared Key (PSK) from quantum entropy, using Qrypt's BLAST protocol. This synchronization occurs by securely sharing cryptographic metadata - not the raw key - neutralizing the "Harvest Now, Decrypt Later" threat. * Automated Key Rotation: The endpoints are configured for continuous, automated and fast PSK rotation, every 10 seconds. * Tunnel Resilience: The VPP WireGuard interface accepts and uses the newly derived key as the PSK, ensuring the tunnel stays up and passes traffic across rotation boundaries with zero packet loss. Engineering better networks - Today and tomorrow. At PANTHEON.tech, Pantheon recognize that security is not a static goal, but a continuous commitment. Protecting your data requires solutions that are robust enough for today's challenges, while remaining adaptable for the threats of tomorrow. The QP-VPP project represents its proactive approach to this continuous evolution. By exploring quantum-resistant tunneling within the FD.io VPP ecosystem, Pantheon is developing the building blocks for high-performance, future-proof network infrastructure. Its goal is to ensure that - as the cryptographic landscape shifts - your data remains protected by the most advanced engineering available. Whether you are evaluating post-quantum cryptography for your network stack, looking to extend VPP's security capabilities, or simply exploring where quantum-safe networking is headed - Pantheon invite you to explore the demo, review the code, and reach out. Interested in deploying quantum-proof networking in your VPP environment? Contact Pantheon or explore its FD.io VPP expertise at pantheon.tech.

Qrypt has brought its quantum-secure BLAST Protocol encryption to NVIDIA Jetson edge AI platforms, including Jetson Orin Nano and Jetson Thor. The integration extends Qrypt's encryption from NVIDIA BlueField DPUs in data centres to edge endpoints, creating a unified security architecture for robotics, autonomous systems and critical infrastructure. Unlike conventional encryption, BLAST generates identical encryption keys independently at each endpoint using quantum entropy, eliminating key transmission across networks. The protocol also automates key provisioning and lifecycle management across large-scale deployments. Qrypt, founded by former CIA operatives, is the only quantum security company in NVIDIA's Inception programme. The technology sources quantum entropy through exclusive licensing agreements with Oak Ridge and Los Alamos National Laboratories and is NIST ESV certified.

Qrypt brings quantum-secure encryption to NVIDIA Jetson. March 12, 2026 Press play to listen to this content NEW YORK, March 12, 2026 - Qrypt, the quantum security company that eliminated encryption key transmission, today announced it has brought its BLAST Protocol end-to-end encryption and quantum-entropy key generation to the NVIDIA Jetson edge AI platform, including Jetson Orin Nano and Jetson Thor. The integration extends Qrypt's quantum-secure encryption from NVIDIA BlueField DPUs in the AI factory to Jetson endpoints at the edge, giving organizations a single security architecture from the data center to deployed robotics, autonomous systems and critical infrastructure. BLAST is a peer-reviewed cryptographic protocol developed by Qrypt Chief Cryptographer Yevgeniy Dodis, a fellow of the International Association for Cryptologic Research and a professor at New York University. Conventional encryption relies on a key-distribution architecture, originally designed for 1970s telecom networks, that binds encryption keys and encrypted data together in the same channel. Replacing the underlying algorithm, as post-quantum cryptography does, does not resolve this structural weakness, because the new algorithms may themselves need to be replaced as cryptanalysis advances. BLAST takes a fundamentally different approach, replacing the key-distribution architecture itself by generating identical encryption keys independently at each endpoint from quantum entropy. No key ever crosses a network, and the keys are never correlated with the data they protect. The protocol also automates key provisioning, rotation and lifecycle management across large-scale deployments, enabling organizations to secure entire fleets of edge devices without rebuilding their existing infrastructure. Edge AI is accelerating into real-world, safety-critical environments such as robotics fleets, autonomous systems and remote industrial monitoring, pushing sensitive data and AI models outside the protection of the data center. Many of these devices will remain deployed for a decade or more, making them prime targets for "harvest now, decrypt later" attacks in which adversaries capture encrypted data today with the expectation of breaking it once quantum computing matures. "AI is moving from the data center to the edge, and the security requirements are moving with it," said Denis Mandich, Qrypt co-founder and CTO, who spent 20 years in the US Intelligence Community focused on national security and advanced technology development. "Organizations building on Jetson need encryption that's quantum-ready on day one, not something they have to retrofit after deployment." As the only quantum security company in the NVIDIA Inception program, Qrypt integrates across the full NVIDIA platform stack. Each Jetson integration is built on a custom Yocto Project kernel tailored to the target device. For Orin Nano, Qrypt developed a kernel upgrade from Linux 5.15 to 6.6 to meet modern security requirements ahead of official NVIDIA support. These foundations are paired with Qrypt's CNSA 2.0 and NIST-aligned cryptography stack. Qrypt's hardware quantum random number generators are also NIST ESV certified, utilizing quantum entropy sourced through exclusive licensing agreements with Oak Ridge and Los Alamos National Laboratories. "The same level of encryption that protects the most sensitive operations in the intelligence community should be available to every organization deploying AI at the edge," said Kevin Chalker, CEO and co-founder of Qrypt, a former CIA operative who founded the company to democratize intelligence-grade cryptography. "With BLAST on NVIDIA Jetson, a robotics fleet or a critical infrastructure operator gets the same quantum-secure protection as a national security mission, from a single architecture that scales from the edge to the AI factory." BLAST Protocol is now available on NVIDIA Jetson Orin Nano and Jetson Thor through Qrypt's early access integration program. Organizations interested in deploying quantum-secure encryption across Jetson-based edge environments can learn more at qrypt.com/contact. About Qrypt Qrypt is the only company in the world to eliminate the need for encryption key transmission. Using quantum entropy sourced through exclusive licensing agreements with Oak Ridge and Los Alamos National Laboratories, Qrypt generates identical encryption keys simultaneously at multiple endpoints, so no key ever crosses a network. The company's BLAST Protocol provides end-to-end encryption, automated key lifecycle management and post-quantum compliance for AI infrastructure, critical networks and edge deployments across the NVIDIA platform stack. Founded by former intelligence community officers Kevin Chalker and Denis Mandich, Qrypt is headquartered at One World Trade Center in New York City. CAMBRIDGE, England, March 12, 2026 - Riverlane today published its new roadmap outlining how its technology... The R&D Centre, together with the planned deployment of a Quantinuum Helios system in Singapore,... SANTA CLARA, Calif., March 12, 2026 - Upscale AI has announced its plan to deliver... PALO ALTO, Calif., March 12, 2026 - PsiQuantum announced today that the company has signed a... The honor recognizes Koller's leadership in collaborative European initiatives to increase HPC expertise and impact... SUNNYVALE, Calif., March 12, 2026 - Synopsys, Inc. has announced advancements across its leading hardware-assisted verification (HAV)...