Encryption
Settlement records often have to stay private for decades. This makes harvest now, decrypt later a real threat: an attacker stores encrypted data today and decrypts it later with a quantum computer. Hyper 0X is post-quantum-resistant under known attacks. This means that its encryption resists the quantum attacks known today.
Hybrid post-quantum key exchange
Section titled “Hybrid post-quantum key exchange”A key exchange lets two parties agree on a secret key over an open network. “Hybrid” means that Hyper 0X uses two key exchange methods together.
- Key exchange: ML-KEM-768, always paired with X25519. NIST FIPS 203 (2024) defines ML-KEM-768. Its security category is 3, about the strength of AES-192. An attacker must break both the lattice problem behind ML-KEM and the elliptic curve behind X25519.
- Data: AES-256.
- Hashes: SHA-2 and SHA-3.
- Sizes: public key 1,184 bytes, ciphertext 1,088 bytes, shared secret 32 bytes.
Modern browsers use the same hybrid group (X25519MLKEM768). The trade-off is larger keys and about 2.3 KB extra per handshake (the first exchange that sets up a connection).
Four layers
Section titled “Four layers”Each layer assumes that the layer before it has already failed. So there are four locks in four places: on the network, inside the server, on the shared ledger and in backups.
| Layer | What it uses |
|---|---|
| 1. In transit | TLS 1.3, hybrid X25519 + ML-KEM-768, AES-256-GCM |
| 2. In computation | Per-party keys |
| 3. On the ledger | Hash commitments and per-party encrypted payloads |
| 4. At rest | AES-256-GCM envelope encryption, master keys held in HSMs (hardware security modules) |