标签：#quantum

Protecting data that must stay secret ten years from now is a problem for today : an adversary can capture your encrypted traffic now and decrypt it once quantum capability exists ( harvest now, decrypt later ). Quipu is a free hybrid post-quantum encryption library for data at rest: it combines proven classical cryptography with the new kind, so that it only breaks if both fall at once. Pure Rust, and why Quipu started out aiming at several languages: a Rust core with a C ABI on top and bindings for Python, Node and Go. It worked, but the lesson was clear: maintaining a stable C interface plus four bindings, each with its own packaging and interoperability tests, was complexity that did not pay for itself against the real goal — protecting data at rest — and it widened the attack surface with unsafe we did not want. Today Quipu is pure Rust : memory safe, no garbage collector, no first-party unsafe . And for people who do not write Rust, it ships as a native Python wheel via PyO3 — the surface that non-Rust users actually need. One codebase, one thing to audit. It is the same philosophy that guides the rest: where good cryptography exists, reuse it; simplicity is a security decision, not a convenience. Installation cargo add quipu # Rust pip install quipu-crypto # Python (native wheel, PyO3) Encrypt and decrypt in Python import quipu # Symmetric, with a passphrase blob = quipu . encrypt_stream ( b " sensitive data " , " my-passphrase " ) assert quipu . decrypt_stream ( blob , " my-passphrase " ) == b " sensitive data " # Post-quantum, for a recipient pub , sec = quipu . generate_keypair () # X25519 + ML-KEM-1024 c = quipu . encode_to_recipient ( b " secret " , pub ) assert quipu . decode_as_recipient ( c , sec ) == b " secret " What is underneath Encryption: XChaCha20-Poly1305 (authenticated AEAD). Key derivation: Argon2id (brute-force resistant) + HKDF. Post-quantum: X25519 + ML-KEM-1024 for keys; Ed25519 + ML-DSA-87 for signatures. Security level: NIST category 5

There are four patterns that bring PQC into a Spring Boot fleet: encrypting payloads between services, locking down database fields, signing documents that need to hold up for decades, and moving service tokens off RS256. Along the way, we discuss why Harvest Now, Decrypt Later is already happening, and why none of this is production-safe until KMS or Vault is in place. By Pankaj Sharma

The Trusted Computing Group has established a new set of requirements to help organizations determine if Trusted Platform Modules are prepared for the era of post-quantum cryptography. This guidance provides a technical benchmark for evaluating whether hardware vendors can protect electronic devices against the future threat of quantum-enabled cyber attacks. Establishing the Post-Quantum Baseline The newly released guidance provides a framework for businesses to verify the security claims made by hardware manufacturers. By creating a standardized set of requirements, the organization ensures that companies can demand proof of protection. This prevents a situation where vendors might claim their products are compliant without offering the full suite of necessary security features. A primary focus of this initiative is the PC Client Platform TPM Profile 1.07. This profile serves as the minimum technical requirement for any module to be considered ready for the next generation of cryptographic challenges. It builds upon the existing TPM 2.0 Library Specification Version 1.85 to include specific elements for quantum-safe protection. Organizations must understand that security in the quantum age involves more than just swapping out one mathematical algorithm for another. True resilience requires a comprehensive approach to hardware-anchored trust. This includes maintaining the integrity of platform identities and attestation over very long periods. Data and identities established today may need to remain secure for several decades. If the underlying hardware is not built to withstand quantum decryption methods, that long-term security is at risk. Current statistics indicate that a vast majority of businesses still lack a formal roadmap for this transition. The Trusted Computing Group president, Joe Pennisi, emphasizes that businesses must look at the broader picture of security. Individual algorithm support is only one piece of the puzzle. Real security comes from a hard

Proteger datos que deben seguir siendo secretos dentro de diez años es un problema de hoy : un adversario puede capturar tu tráfico cifrado ahora y descifrarlo cuando exista la capacidad cuántica ( harvest now, decrypt later ). Quipu es una librería libre de cifrado híbrido post-cuántico para datos en reposo: combina criptografía clásica probada con la nueva, de modo que solo se rompe si ambas caen a la vez. Rust puro, y por qué Quipu nació apuntando a varios lenguajes: un núcleo en Rust con una C ABI encima y bindings para Python, Node y Go. Funcionaba, pero la lección fue clara: mantener una interfaz de C estable más cuatro bindings, cada uno con su empaquetado y sus pruebas de interoperabilidad, era complejidad que no pagaba para el objetivo real —proteger datos en reposo— y ampliaba la superficie de ataque con unsafe que no queríamos. Hoy Quipu es Rust puro : memoria segura, sin garbage collector , sin unsafe de primera parte . Y para quien no programa en Rust, se distribuye como rueda nativa de Python (vía PyO3) — que es la superficie que el cliente que no es de Rust de verdad necesita. Una sola base de código, una sola cosa que auditar. Es la misma filosofía que guía el resto: donde hay buena criptografía, se reutiliza; la simplicidad es una decisión de seguridad, no una comodidad. Instalación cargo add quipu # Rust pip install quipu-crypto # Python (rueda nativa, PyO3) Cifrar y descifrar en Python import quipu # Simétrico con contraseña blob = quipu . encrypt_stream ( b " datos sensibles " , " mi-passphrase " ) assert quipu . decrypt_stream ( blob , " mi-passphrase " ) == b " datos sensibles " # Post-cuántico para un destinatario pub , sec = quipu . generate_keypair () # X25519 + ML-KEM-1024 c = quipu . encode_to_recipient ( b " secreto " , pub ) assert quipu . decode_as_recipient ( c , sec ) == b " secreto " Qué hay debajo Cifrado: XChaCha20-Poly1305 (AEAD autenticado). Derivación de claves: Argon2id (resistente a fuerza bruta) + HKDF. Post-cuántico: X25519

InfoQ editorial staff and friends of InfoQ are discussing the current trends in the domain of Cloud and DevOps as part of the process of creating our annual 2026 trends report. By Steef-Jan Wiggers, Matt Saunders, Shweta Vohra, Daniel Bryant, Mark Silvester

This is good : Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency , we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.

Zulfi Alam thinks his team doesn’t need to “prove” they engineered a new state of matter in their bid to reinvent computing. Science would disagree.

Una discusión sobre un archivo digital casi nunca se pierde por lo que el archivo dice. Se pierde una pregunta antes: ¿Cómo sabemos que ese es el archivo que usted recibió, y no el que editó anoche? Si la respuesta es "confíe en mí", ya perdiste. Y da igual cuánta razón tengas en el fondo. Este problema no es exclusivo de un juzgado. Lo tiene el auditor que recibe un volcado de logs, el equipo que documenta un incidente, quien conserva la copia de un contrato firmado por correo. En todos los casos hace falta lo mismo: poder demostrar que un conjunto de bytes no cambió desde un momento determinado, y que lo demuestre alguien que no seas tú . Para eso escribí Tunjo : una herramienta en Rust que recorre un material en solo lectura, calcula su huella y firma un acta verificable por cualquiera. Por qué un árbol y no un hash Lo obvio sería concatenar todo y sacar un SHA-256. Funciona, y es inútil en la práctica. Cuando alguien discute un archivo —un correo concreto entre cuatro mil— con un hash único solo puedes ofrecer dos cosas: o entregas el conjunto completo para que se recalcule, o pides que te crean. La primera opción expone material que no tiene por qué exponerse; la segunda no es una prueba. Un árbol de Merkle resuelve exactamente eso. Cada archivo es una hoja, cada par de nodos se combina hacia arriba y queda una raíz. Para demostrar que una hoja pertenece a esa raíz basta con exhibir esa hoja y el camino de hashes hasta arriba: unos pocos kilobytes. El resto del conjunto no se toca. Dos detalles del árbol que no son opcionales: // Separación de dominio: una hoja nunca puede hacerse pasar por nodo interno. h . update ([ 0x00 ]); // hoja h . update ([ 0x01 ]); // nodo interno // Y la raíz ata el número de hojas. h . update ([ 0x02 ]); h . update ( n . to_be_bytes ()); Sin lo primero, un hash de hoja podría presentarse como si fuera un nodo del árbol. Sin lo segundo aparece la ambigüedad clásica de los árboles con número impar de hojas: dos conjuntos distintos pued

When engineers discuss quantum computing, the conversation usually focuses on future supercomputers cracking traditional encryption passwords in a matter of seconds. As a systems architect who spends my days building distributed platforms, which are networks of independent cloud servers working together as a single application, I see a different, highly practical challenge taking shape. The transition to quantum-resistant security is not simply a theoretical math problem. It is an infrastructure challenge that will directly impact network throughput, memory usage, and messaging efficiency across global cloud environments. To protect sensitive enterprise records and business platforms against future quantum threats, security organizations are transitioning to Post-Quantum Cryptography. This field involves building new mathematical algorithms that quantum computers cannot easily solve. However, these stronger defense mechanisms come with a major trade-off in size. Traditional cryptographic signatures, which are digital verification stamps used to prove that a data message comes from an authentic sender and was not altered, are remarkably small. An older, standard signature might only take up sixty bytes of memory. By comparison, a quantum-safe signature can easily require several thousand bytes. In a simple website, adding a few extra kilobytes to a security header goes unnoticed. But modern cloud infrastructure relies heavily on event-driven architecture, a design strategy where dozens of microservices communicate by constantly publishing tiny, real-time updates to shared message queues. In these systems, the actual business payload might only be a small status change containing twenty bytes of text. If the quantum security stamp attached to that message is three thousand bytes, the overhead of the security layer completely outweighs the actual data being sent. When security footprints expand by orders of magnitude, the physical realities of computer networking take

Probabilistic Graph Neural Inference for bio-inspired soft robotics maintenance with ethical auditability baked in I remember the moment it clicked. I was hunched over a workbench in my home lab, staring at a tangled mess of silicone tentacles—a soft robotic octopus arm I’d 3D-printed and embedded with pneumatic channels. The arm was supposed to mimic the graceful, adaptive movements of a real cephalopod, but after a few cycles, it had developed a slow leak at one of the joint interfaces. The pressure sensors were giving erratic readings, and my traditional rule-based diagnostic script was useless. I’d spent weeks training a simple neural network to detect anomalies, but it kept flagging benign sensor noise as critical failures. That’s when I stumbled upon a paper on probabilistic graph neural networks (PGNNs) for molecular dynamics, and I realized: soft robotics maintenance isn’t about deterministic predictions—it’s about reasoning under uncertainty over a complex, interconnected system. This article is the story of how I built a PGNN-based inference system for bio-inspired soft robots, with ethical auditability baked in from the ground up. Technical Background: Why Soft Robotics Needs Probabilistic Graph Inference Soft robotics is fundamentally different from rigid robotics. A rigid arm has well-defined joints, links, and sensors; failures are often binary (motor burnout, gear slip). But a soft robotic tentacle is a continuum of deformable material with distributed sensing and actuation. The system’s state is a high-dimensional, partially observable probability distribution over material strains, pressures, and temperatures. Traditional diagnostic models—like support vector machines or feedforward neural networks—treat each sensor as an independent feature, ignoring the spatial and temporal dependencies that define soft robot behavior. In my research of graph neural networks, I realized that a soft robot is naturally a graph: each sensor node (pressure, strain, te

Introduction Having laid out some mathematical foundations in the [previous part][1], we will proceed to discuss quantum gates and circuits in depth here. As usual, we will drive home the theories with worked examples from [@Rieffel2011] and check their accuracy with qiskit and/or cirq code. Prerequisite Understanding quantum gates and circuits will be greatly aided by the knowledge of classical gates (AND, OR, NOT, XOR and the universal gates: NAND and NOR). Also, some familiarity with the Python programming language will help you understand qiskit and/or cirq code. Classical & Quantum gates A classical computer, possibly the one you're reading this with, is a sophisticated engineering piece, no doubt. However, the underlying "magic" comprises logic gates. The National Institute of Standards and Technology (NIST) gives this incredible analogical description of classical computers in relation to logic gates [@NISTQGATE2026]: Traditional computers are like microscopic cities. The roads of these cities are wires with electricity coursing through them. These roads have lots of gates, known as logic gates, which enable computers to do their job. Like physical gates that allow or block cars, logic gates allow or block electricity. Electricity that goes through the gates represents a “1” of digital data, and blocked electricity is a “0.” When you pick up a motherboard, for instance, you may not see the said gates as they are made of tiny transistors (in modern systems, MOSFETs) in specific combinations. Also, the $0$ and $1$ referred to in the analogy mean low and high voltage ranges, respectively. Their actual voltage values depend on the hardware. :::note All schematics were written in and rendered by @schemd/core . Check it out. ::: Logic Gates refresher Since we will be realizing some classical circuits using quantum gates, it's necessary to get familiar with common logic gates. NOT ($\neg$) Gate This gate takes a single classical bit and flips it. For instance, if $0

Like its U.S. counterpart, the European Chips Act aims to foster the semiconductor industry — in part thanks to state subsidies. One of the beneficiaries is QuantumDiamonds, a German startup that applies a novel approach to inspecting chips.

France is accelerating its transition to post-quantum encryption: France’s cybersecurity agency ANSSI said on Tuesday it would stop certifying security products that lack quantum-resistant encryption, a move that will force government bodies and critical operators to shift away from older systems. Samih Souissi, ANSSI’s chief of staff, said at the France Quantum conference that the agency would halt such certifications from 2027, and that businesses should be buying only quantum-safe products by 2030. ANSSI approval is required for use in French government agencies and critical infrastructure, making the policy a de facto phase-out of older encryption...

placeholder

[Excerpted from THE QUANTUM COLLAPSE CHRONICLES — not science fiction, but a grounded forecast of what may come when quantum computation dismantles the cryptographic foundations of our digital civilization. These articles explore the collapse of computational trust and the brutal reconstruction of the world that follows.] The history of human civilization is often defined by sudden, violent shifts in the nature of power. We speak of the fall of empires, the industrial revolutions, and the splitting of the atom. But in the mid-2030s, the world experienced a collapse that was not made of steel or stone, but of mathematics. It was a quiet, clinical, and utterly devastating unraveling of the digital fabric that held modern society together. To understand The Quantum Collapse , one must look past the headlines of the era and into the humming, sub-Kelvin depths of the dilution refrigerators that changed everything. This is the story of how the transition from probabilistic experimentation to deterministic computation rendered the world's secrets transparent and its economies obsolete. The Death of Noise: The Rise of Dr. Aris Thorne For the first three decades of the 21st century, quantum computing was a game of chance. Scientists operated in the era of Noisy Intermediate-Scale Quantum (NISQ) devices—machines so temperamental and prone to error that every calculation was a desperate struggle against environmental noise. In those days, a single stray photon or a microscopic fluctuation in temperature could collapse a delicate superposition, turning a groundbreaking calculation into useless digital static. The turning point arrived in 2036 at the Institute for Advanced Quantum Engineering (IAQE) in the High Sierras. The air in the facility didn't vibrate with the erratic drone of the late 2020s; instead, it carried a heavy, rhythmic thrum—the sonic signature of the Lattice-Array-9 (LA-9). At the center of this revolution was Dr. Aris Thorne, the lead architect of the LA-9 pr

Quantum Space says SPACs aren't dead as it seeks a $1.2 billion deal to build military spacecraft.

Microsoft announced the general availability of Microsoft Discovery, its Azure-based platform for deploying autonomous AI agent teams in scientific R&D. The platform powered the development of Majorana 2, a topological quantum chip with 1,000x reliability improvement and 20-second qubit lifetimes. Microsoft now targets a scalable quantum computer by 2029, halving its original timeline. By Steef-Jan Wiggers

Qisquiz: A Qiskit v2.X Certification Prep App I built Qisquiz , a web app for learning Qiskit v2.X and preparing for the IBM Certified Quantum Computation using Qiskit v2.X Developer - Associate certification exam. You can try the app here: https://qisquiz.vercel.app/ The GitHub repository is here: https://github.com/dorakingx/qisquiz The concept of Qisquiz is simple: Master Qiskit, one quiz at a time. In other words, Qisquiz is a quiz-based certification prep app that helps learners study Qiskit one question at a time. The target exam is: Exam C1000-179: Fundamentals of Quantum Computing Using Qiskit v2.X Developer Why I Built Qisquiz Qiskit is one of the most important development tools for learning and building quantum computing applications. It is useful for creating quantum circuits, running simulations, using IBM Quantum hardware, and experimenting with quantum algorithms. However, Qiskit v2.X includes several APIs and concepts that learners need to understand carefully. For example, certification prep requires knowledge of topics such as: Qiskit Runtime SamplerV2 EstimatorV2 PUBs, or Primitive Unified Blocs BackendV2 backend.target Transpilation ISA circuits Dynamic circuits OpenQASM 3 Result object handling Little-endian and big-endian interpretation These topics can be learned by reading documentation, but I felt that active practice through quizzes is especially useful for exam preparation. That is why I built Qisquiz , a quiz-based learning app focused on Qiskit v2.X. What Is Qisquiz? Qisquiz is an independent quiz-based learning app for Qiskit v2.X. The current version is organized around the 8 sections of the IBM Qiskit v2.X Developer certification exam. The current question bank includes: 120 original questions 44 code-based questions 40 hard questions 8 sections 15 questions per section Qisquiz is not an official IBM or Qiskit product. It is an independent learning tool that I built to help myself and other learners prepare more effectively. Covered E

Quantinuum, a quantum computing startup, is losing millions. Investors want in anyway.

Meta-Optimized Continual Adaptation for coastal climate resilience planning with zero-trust governance guarantees It started with a nagging feeling of inadequacy. I was deep into a research project on adaptive AI for infrastructure planning, studying how reinforcement learning agents could optimize sea-wall placements and evacuation routes. The models worked—beautifully, in fact—on static datasets. But the moment I fed them real-time satellite imagery of a rapidly eroding coastline or a sudden storm surge, they stumbled. They forgot previous strategies, overfit to the new event, or, worse, made decisions that violated basic safety constraints. I realized then that the problem wasn't just about better AI; it was about trust and adaptation in the face of chaos. My exploration of this challenge led me down a rabbit hole of meta-learning, continual learning, and cryptographic governance. What emerged was a framework I now call Meta-Optimized Continual Adaptation (MOCA) with zero-trust governance guarantees—a system designed not just to learn, but to learn how to learn in dynamic, high-stakes coastal environments, all while ensuring that every decision is auditable and tamper-proof. This article shares that journey, the technical breakthroughs, and the hard-won lessons from my experiments. Technical Background: The Three Pillars of MOCA The core insight behind MOCA is that coastal climate resilience planning requires three seemingly contradictory properties: Continual adaptation – The system must update its models as new data streams in (e.g., sea-level rise, storm frequency, erosion patterns) without catastrophic forgetting. Meta-optimization – It must learn the learning algorithm itself, so that adaptation becomes faster and more sample-efficient over time. Zero-trust governance – Every model update and decision must be cryptographically verifiable, with no single point of failure or authority. In my research, I found that existing approaches tackled these individually