The standardization of new post-quantum cryptographic algorithms by NIST in August 2024 has shifted the focus to a critical, often overlooked vulnerability: application programming interfaces, the company says. Sensitive data including health records, financial information, government communications, and intellectual property is increasingly exchanged through APIs and is at risk of a “harvest now, decrypt later” attack, where captured data is decrypted once quantum computers become powerful enough.
Researchers explain the risk with a simple test; an organization is already exposed if “the number of years its data must stay confidential, plus the number of years migration will take, is greater than the number of years until quantum computers can break current encryption.” For organizations with long-lived data and slow procurement cycles, analysts believe that threshold may already have been crossed.
NIST Standards Drive Focus to API Exposure Risks
Federal Information Processing Standards 203, 204, and 205, published by NIST in August 2024, have fundamentally altered the post-quantum cryptography landscape by solidifying ML-KEM, ML-DSA and SLH-DSA as the new standards. This standardization isn’t merely academic; it’s driving a concentrated focus on the vulnerabilities present within application programming interfaces (APIs), which now serve as primary conduits for sensitive data. The potential for long-term data compromise is particularly acute for sectors handling information requiring decades of confidentiality.
Regulatory pressures are further accelerating the need for proactive migration. The U.S. National Security Agency’s Commercial National Security Algorithm Suite 2. 0 (CNSA 2. 0) establishes timelines for national security systems, with related obligations extending to vendors through frameworks like FedRAMP, FISMA and HIPAA.
Long-lived data left unprotected risks becoming an audit violation. SuperQubit Inc. has responded to these challenges with SQ QuantumEdge, a post-quantum REST API platform designed to protect API sessions using ML-KEM key establishment and ML-DSA signatures, employing a hybrid handshake that maintains a classical algorithm alongside the quantum-resistant one. The platform’s architecture prioritizes security at multiple levels. Both the load-balancing edge and the API server are written in Rust, a memory-safe programming language, mitigating the risk of vulnerabilities like the 2014 Heartbleed bug.
SuperQubit also emphasizes cryptographic agility, enabling organizations to adopt or retire algorithms through configuration rather than extensive re-architecture. “Because the handshake is hybrid, the company says existing clients continue to connect normally, and post-quantum protection can be enabled one endpoint at a time.” The company identifies government, defense, financial services, healthcare, energy and telecommunications as sectors with the most pressing need for this technology, given their long-term data confidentiality requirements and stringent regulatory oversight.
Rust and CBOM Enhance API Security & Crypto Agility
A key component of this agility is the cryptographic bill of materials, or CBOM, which provides continuous evidence of algorithm usage across an organization’s API surface for auditors. “A CBOM shows which algorithms are in use across an organization’s API surface, providing continuous evidence for auditors instead of a once-a-year review,” according to the company. This continuous monitoring is increasingly important as regulatory frameworks like FedRAMP, FISMA, and HIPAA extend obligations to vendors and service providers.
The platform’s cryptographic foundation relies on AWS-LC, Amazon’s open-source cryptographic library, and its FIPS 140-3 validated module that includes ML-KEM. Because ML-KEM received NIST approval, the hybrid handshake employed by SQ QuantumEdge operates within FIPS-approved key establishment protocols, according to the company. This hybrid approach allows for continued compatibility with existing clients while simultaneously layering post-quantum protection.
The edge component is built on Pingora, a Rust framework that currently handles a substantial portion of Cloudflare’s global traffic, demonstrating its capacity for high-volume API management. SuperQubit also incorporates constant-time implementations to resist timing attacks and clears key material from memory after use, further hardening the system against potential exploits.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
