ML-KEM key encapsulation
FIPS 203 key establishment for the session keys your traffic actually depends on.
Post-quantum security
Rabbit Security PQC
Post-quantum cryptography for systems that already exist — hybrid handshakes, managed keys, and a migration path that doesn’t start with a rewrite. Part of the intelligent services platforms we build.
What it is
Change the cryptography, not the application.
Traffic captured today can be stored and opened later, once the hardware catches up. That turns the move to post-quantum algorithms into a scheduling problem rather than a someday problem.
Rabbit Security implements the standardised primitives — ML-KEM for key encapsulation (FIPS 203) and ML-DSA for signatures (FIPS 204) — and runs them in hybrid mode alongside the classical algorithms you already trust.
Keys, rotation, and the audit trail sit behind one interface, so the algorithm underneath can change without touching application code. That is the whole point: crypto-agility.
Capabilities
The standardised primitives, managed
Post-quantum algorithms are published. Running them safely in a live system is the work.
ML-DSA signatures
FIPS 204 signing and verification for artifacts, tokens, and machine identities.
Hybrid handshakes
Classical and post-quantum key exchange run together, so the session holds if either one holds.
Key management
Generate, store, and scope keys per service — no shared secrets sitting in a config file.
Rotation and audit trail
Scheduled rotation plus a signed record of every key issued, used, and retired.
Crypto-agility
Swap algorithms behind a stable interface, so the next standard is a config change.
How it works
A migration you can run in order
01
Inventory
Find where cryptography actually happens: handshakes, tokens, stored secrets, signed artifacts.
02
Go hybrid
Turn post-quantum on alongside the classical algorithm. Existing clients keep working.
03
Centralise keys
Issue and scope keys per service, with rotation on a schedule instead of on a ticket.
04
Prove it
Export the audit trail: which algorithm, which key, which service, and when.
Who it’s for
Teams with a date on the calendar
Long-lived data
Records that must stay confidential for longer than today’s cryptography can promise.
Platform and infrastructure teams
Services that terminate TLS, sign artifacts, or hand out tokens on someone else’s behalf.
Compliance-driven programmes
Anyone who has to show the migration plan, the algorithms in use, and the evidence behind both.
Part of our platforms
Use it on its own, or have us build it in
Rabbit Security is the encryption and key management inside the platforms we design and build for clients. There are two ways to get it.
Use it on its own
Take it as a product and run the migration on your own schedule. Inventory where cryptography happens, turn post-quantum on beside the classical algorithms, and keep existing clients working — the four steps above are the order to do it in.
See how it works — the four steps of the post-quantum migration, in orderHave us implement it
We bring Rabbit Security in as the encryption and key management of a platform we build for you — new, or overhauled phase by phase. Every phase is scoped up front, and the source stays yours.
How we build platforms — a new platform built around Rabbit Security, or an existing system overhauled in phasesNot sure which one you need? Tell us what you are running today — a TLS estate you inherited, or a questionnaire that now asks about post-quantum — and we’ll say whether that is the product on its own or phase one of a platform. Talk to us about Rabbit Security.
Start the migration early.
We’ll map your handshakes and signatures, then show you the order to do them in.