Post-quantum cryptography
For systems where a compromise cannot be allowed to spread: sovereign networks, regulated operators, infrastructure that cannot extend trust to every machine it runs on.
The approach
The work began outside cryptography, in a programme on how generative processes produce observable form: semiotics, category theory, the geometry of interactions. What it produced was a class of functions where the path taken decides what happens next.
Cryptography turned out to be where that mattered, and the people who might have found it were looking elsewhere. That it would make a good cipher was clear early. How good was not.
Ousia SA founded in Geneva.
The theory formalised.
A cipher built. The patent filed in October 2019, published as US 2022/0382521 A1 and readable today.
The single cipher became a class.
That work is complete.
The claim
Under complete compromise of the machine, the key holds.
Memory and registers included: cold boot, a hypervisor snapshot, a hostile host, a neighbour in shared tenancy. The compromise stops at the session being watched: other sessions stay closed, and traffic recorded earlier does not become readable: the harvest-now-decrypt-later case.
A machine may also be watched: power analysis, timing, emissions. The same structure answers. That analysis isolates a fragment of the key behind each leaked value; here there is no fragment to isolate, because what determines each step is the whole history that produced it. The setup that consumes the key is a conventional target, and is protected as one.
Sessions protected by one key, after a complete capture of the machine.
The decision
The structure is not fixed in advance. It is assembled as the message is read.
Everything below follows from that. None of it is bolted on afterwards.
| A secure channel needs | Conventionally | Here |
|---|---|---|
| Encryption | A block cipher and a mode | The construction |
| Message authentication | A separate MAC | Built in |
| Ordering, anti-replay | Record-layer counters and windows | Built in |
| Key derivation | A separate derivation step | The construction is its own |
| Padding, framing | Protocol-specific | Not needed |
| Side-channel resistance | Masking, added around the cipher | Built in |
| Key agreement, peer identity | Certificates and an authority chain | Not covered |
Once certification supports deployment, the construction replaces the cipher suite and the key-derivation step in an existing stack, and the protocol above it does not change. Some deployments already run without public-internet certificate authorities: pre-shared keys, a private authority, sovereign internal networks. There it replaces the encryption stack entirely.
The limits
Stated before being asked, because a construction that cannot say where it fails is not worth reading further.
We are not an alternative to the standardised algorithms. For traffic in volume, AES is the right answer.
The window
What sets those dates is what is already being recorded. Traffic captured today can be kept and opened later, so anything with a long confidentiality life is already exposed, well before the deadline.
Not resting everything on one family of assumptions is the stated position of the organisations writing the standards: NIST has added a fifth algorithm from a different mathematical family, Germany's BSI recommends code-based options alongside the lattice ones, and France's ANSSI requires hybrid constructions beyond 2030.
The construction absorbs a post-quantum key-exchange secret directly, and works alongside that migration.
The programmes
complete under way next
encrypt(key, iv, message) → ciphertext
That is the whole interface: no mode to select, no authenticator to attach, no
derivation step, no padding. For infrastructure where a machine may be taken whole:
secure elements, confidential computing, shared tenancy, long-lived
archives.
The aim
Cryptography assumes a hostile channel and a safe machine. For most of the world it is now the other way round.
Those assumptions came from military communication: operators who do not know one another, equipment expected to be captured, secrets that expire on a schedule, and an organisation standing behind all of it. Civilian infrastructure has none of that. Identities persist, records keep their value for decades, and the machine holding them is usually someone else's.
The aim is cryptography built for whoever holds the data, not for whoever issues the keys. That is a long piece of work, and it is the one we are doing.
Contact
Ousia works with independent auditors, certification bodies and silicon partners along the path to deployment. Enquiries from cryptographers, integrators and agencies are welcome.