Post-Quantum Key Policy

The mesh ships with post-quantum cryptography as part of its session setup — the policy question is where, when, and how strictly you apply it.

Hybrid session setup

Every mesh session is established with a hybrid X25519 + ML-KEM-768 key exchange. The classic curve provides compatibility and battle-tested performance; the module-lattice scheme (the Kyber-family standard) protects the session against harvest-now-decrypt-later adversaries. Payloads are then protected with AES-GCM, bound to the QUIC connection, and verified with confirmation tags and replay windows on both ends.

The practical meaning: traffic that crosses the mesh today is already resistant to a quantum-capable attacker collecting it in the future. That is the default posture, not a special configuration.

A policy surface, not a checkbox

Post-quantum settings should be treated as a policy surface tied to environment risk, not a decorative checkbox. An internal lab can accept a relaxed posture; a deployment carrying customer data, production credentials, or long-lived secrets should pin the strictest posture available. The key is to decide deliberately, per environment, and record the decision where operators can find it.

Policy decision record (per environment)

  environment: production
  session setup: hybrid X25519 + ML-KEM-768
  required links:  all (node-node, node-relay, ingress, api)
  rotation:        on node re-enrollment and scheduled quarterly
  legacy peers:    isolated on a dedicated relay, denied product access

Rotation and legacy peers

Document which links require hybrid exchange, how rotation is handled, and how incompatible legacy peers are isolated. Rotation should ride the existing lifecycle — re-enrollment, package updates, and scheduled reviews — rather than becoming a separate ritual that gets postponed. Legacy peers that cannot speak the hybrid protocol must be isolated to their own relay or segment and denied access to product services, so their weakness does not become the environment's weakness.

Compatibility is a liability. Every legacy peer you keep is a policy exception you must remember to maintain. Treat exceptions as temporary and schedule their retirement — the audit trail will tell you if you forget.

The full post-quantum migration

The roadmap for the platform is a full post-quantum migration: the hybrid setup is the transition phase, and the end state is a mesh where classic-only negotiation no longer exists anywhere. Environments that adopt strict hybrid posture today — and keep their legacy exceptions short-lived — are the ones that complete that migration without a forced rebuild.

Post-quantum policy only matters if the rest of the perimeter is sound. Pair it with zero-trust access policy and audit and logging so the policy surface is enforced and evidenced, not just documented.

Previous Deployment Flow Next Zero-Trust Policies