Two answers to the same quantum threat. PQC swaps the broken mathematics for harder mathematics and keeps the architecture; QuStream stops relying on the secrecy of mathematics at all. This sets them side by side — how each secures a link, how the first secret is delivered, what they cost on the wire and on the device, and where each one wins.
Today's web rests on TLS 1.3, and TLS 1.3 rests on two pieces of public-key mathematics: an elliptic-curve key exchange (X25519 or ECDH) to agree a session key, and an RSA or elliptic-curve signature to authenticate the server. Shor's algorithm breaks both. A sufficiently large quantum computer recovers the private key from the public one, so every session secured this way — and every session recorded today against that future machine — is exposed. With over four-fifths of the web served over HTTPS, the exposure is close to universal.
There are two ways to answer this, and they are genuinely different in kind. Post-quantum cryptography (PQC) keeps the TLS architecture exactly as it is and replaces the vulnerable primitives with new ones — lattice-based key encapsulation and lattice- or hash-based signatures — whose security rests on mathematical problems believed to be hard even for a quantum computer. QuStream takes the other road: it derives keys by walking a secret path through quantum-random material and leans, where it can, on information-theoretic security — secrecy that holds against unlimited computation because it depends on no unbroken problem at all.
The honest summary, stated up front: for the open web at scale, PQC is the right answer — standardised, drop-in, and increasingly mandated. For closed, high-assurance, long-lived, broadcast, or constrained networks, QuStream is the structurally stronger one, and the two compose: QuStream can use a single PQC handshake as its bootstrap and then move security to a tier no future computer can reach. The rest of this document earns those two sentences.
NIST standardised the new primitives in 2024: ML-KEM (FIPS 203, formerly Kyber) for key establishment, and ML-DSA (FIPS 204, formerly Dilithium), SLH-DSA (FIPS 205, SPHINCS+) and the forthcoming FN-DSA (Falcon) for signatures. In TLS the deployed pattern is hybrid: the classical X25519 key exchange runs in parallel with ML-KEM-768, and the two shared secrets are concatenated into the normal TLS 1.3 key schedule. An attacker must break both to recover the session — so the post-quantum part can only help, never weaken. This is the configuration Google, Cloudflare and AWS already serve.
ML-KEM's secrecy rests on the conjectured hardness of the Module Learning-With-Errors problem; ML-DSA on a related lattice problem; SLH-DSA on the security of hash functions. These are computational assumptions, and that is the point to hold onto. They are believed to resist quantum attack, but "believed" is doing load-bearing work: structured-lattice cryptanalysis is roughly a decade old, far younger than the forty-odd years of confidence behind RSA and elliptic curves, and the field has already seen claimed quantum attacks on lattice problems appear and be withdrawn. PQC moves the wall and makes it higher. It does not remove the wall — and a recorded ciphertext stays vulnerable for as long as the assumption behind it survives.
This is why the harvest-now-decrypt-later threat is the organising concern. Surveys of cryptographers put a meaningful probability on RSA-2048 falling within the decade; whatever the exact odds, traffic captured today must stay confidential for the lifetime of the data it carries, which for state, financial and infrastructure records is measured in decades. PQC's bet is that the lattice assumption holds for that entire window. PQC standardised, drop-in, no provisioning — and only as durable as one unbroken assumption.
Every QuStream link begins from a shared secret state — the initial PDK (the path-derivation key of §2 of the technical introduction). After that first secret is in place, the ratchet, the public Q-blocks and the un-storable broadcast carry the link forward without ever distributing bulk key files again. So the whole question of "key distribution," which dominates a PQC deployment session after session, collapses for QuStream into a single one-time problem: how does each endpoint acquire PDK0? There are four practical channels, and they are not exclusive.
The PQC-wrapped bootstrap deserves emphasis because it inverts PQC's central weakness. A pure-PQC link asks the lattice assumption to hold for the entire lifetime of every record it ever carries — decades. A QuStream link bootstrapped by one ML-KEM handshake asks the assumption to hold only at the instant of provisioning. Immediately afterwards the ratchet moves the state forward and, in continuous-stream mode, the bits the secret walk selects are bits no adversary could store — they have already vanished from the air. So even if the lattice problem were broken the day after bootstrap, a harvest-now-decrypt-later adversary recovers nothing: the only thing the broken handshake protected was a seed that has long since ratcheted away, and the traffic itself was never computationally protected to begin with.
The first comparison is of kind, not degree. Classical TLS and PQC TLS share an architecture and a dependency on unbroken mathematics; they differ only in which mathematics. QuStream changes the dependency.
| Property | Classical TLS (RSA / ECDH) | PQC TLS (ML-KEM / ML-DSA) | QuStream |
|---|---|---|---|
| Security foundation | Factoring / discrete log | Structured-lattice / hash hardness | Information-theoretic + PQC tier |
| Core assumption | Computational, ~45 yr studied | Computational, ~10 yr studied | None (ITS tiers) · PRF/AEAD (comp. tier) |
| Quantum resistance | Broken by Shor | Believed resistant | Unconditional (ITS) · post-quantum (comp.) |
| Harvest-now-decrypt-later | Fully exposed | Resistant while assumption holds | Immune — bits vanish; bootstrap ratchets away |
| If the assumption falls | Total, retroactive break | Total, retroactive break | Past ITS/everlasting traffic stays safe |
| Authentication | RSA / ECDSA signature | ML-DSA / SLH-DSA signature | Wegman–Carter one-time MAC (ITS) or sig |
| Forward secrecy | Ephemeral DH | Ephemeral KEM | One-way ratchet · everlasting in stream mode |
| PKI / CA dependency | Required | Required (PQ-PKI) | Optional — none in pre-provisioned mode |
| Key supply per session | Fresh DH each time | Fresh KEM each time | Local derivation; no per-session asymmetric op |
| Topology fit | Interactive 1:1 | Interactive 1:1 | 1:1, broadcast, and one-to-many native |
| Crypto-agility burden | Low | High — may need re-migration if lattices weaken | ITS tier needs no re-migration, ever |
Read down the right-hand column and the pattern is consistent: where PQC offers resistance conditional on an assumption, QuStream's information-theoretic tiers offer unconditional security, at the cost of needing the provisioning or the broadcast fabric that those tiers rest on. That trade — assumption-free security in exchange for infrastructure — is exactly why the deployment context decides the winner.
The artifacts a session carries are the cleanest empirical contrast, because the numbers are fixed by the standards. ML-KEM-768 needs a 1,184-byte encapsulation key and a 1,088-byte ciphertext to agree the same 32-byte secret that X25519 agrees in 32 bytes each way. The authentication side is heavier still: ML-DSA-65 is a 1,952-byte public key and a 3,309-byte signature against Ed25519's 32 and 64; SLH-DSA trades a tiny 32–64-byte key for signatures from roughly 8 KB to nearly 50 KB. QuStream, once bootstrapped, carries no asymmetric material per session — each message key is derived locally from the public Q-block, so the marginal per-message secret on the wire is effectively nil.
| Artifact (Level 3) | Classical | PQC | QuStream |
|---|---|---|---|
| Key-agreement, each way | X25519 · 32 B | ML-KEM-768 ek 1,184 B / ct 1,088 B | public Q-block (shared) · 0 B secret |
| Signature public key | Ed25519 · 32 B | ML-DSA-65 · 1,952 B | — (no per-session PK) |
| Signature | Ed25519 · 64 B | ML-DSA-65 · 3,309 B · SLH-DSA 8–50 KB | one-time MAC tag · 16–32 B |
| Hybrid ClientHello share | 32 B | X25519+ML-KEM · 1,216 B | n/a after bootstrap |
| Added auth path / handshake | ~0.2 KB | tens of KB (chain+SCT+OCSP) | ~0 KB |
Size becomes latency at the packet boundary. A hybrid ClientHello near 1.2 KB approaches the ~1,400-byte MTU; the certificate path pushes well past it, so handshake messages fragment across multiple TCP segments — and a split ClientHello has been observed to confuse middleboxes and load-balancers badly enough to fail the connection outright. Cloudflare's deployment measurements are the reference points: adding roughly 9 KB to a handshake cost about 15% in handshake time, and crossing the ~10 KB mark forced an extra round trip that slowed the handshake by over 60%. First post-quantum connections typically add 50–200 ms, and on lossy links the penalty compounds — measured at roughly 13–19 ms of added handshake latency for every 1% of packet loss, because larger handshakes mean more segments to lose and retransmit.
QuStream sidesteps the entire class of problems. After bootstrap there is no per-session key exchange to fragment, no certificate chain to ship, and in continuous-stream mode no interactive handshake at all — two endpoints aligned by clock and PDK simply read the broadcast and arrive at the same key. The cost that PQC pays on every fresh connection, QuStream pays once.
The device story splits the PQC family. ML-KEM is computationally light — comparable to ECDH and often faster than RSA. ML-DSA is heavier but tolerable. The hash-based fallback SLH-DSA is brutal: place it in an interactive leaf certificate and signing dominates, driving handshake latency and server compute up by orders of magnitude. Falcon/FN-DSA signs compactly but needs constant-time floating-point arithmetic — without it, signing runs roughly 20× slower, and a careless implementation leaks the private key through timing during the handshake itself. On a Raspberry Pi or a microcontroller-class IoT endpoint, the larger keys, the lattice and big-integer math, and the memory footprint all bite.
QuStream's derivation is a bit-walk over a buffer followed by symmetric primitives — no lattice arithmetic, no big-integer exponentiation, no floating-point side-channel surface. It runs comfortably on the same constrained MCU that struggles with a PQC signature, which is why the smart-meter and tactical-radio profiles in the use-case set are realistic rather than aspirational. QuStream tiny endpoint, no asymmetric math; PQC ML-KEM light, signatures heavy, SLH-DSA/Falcon hazardous on constrained or interactive paths.
TLS is an interactive, point-to-point protocol with a PKI behind it, and at scale that shape is the cost. Every fresh session re-runs the handshake and re-ships the authentication path; in a service mesh, a serverless tier, or dense machine-to-machine telemetry, the multiplier is the number of connections, and PQC multiplies the per-connection bytes. The genuinely hard part, as Cloudflare puts it, is that a single connection already carries several signatures — leaf, intermediates, certificate-transparency, revocation — and post-quantum signatures inflate every one of them. A post-quantum PKI must then issue, rotate and revoke certificates built from kilobyte-scale keys and signatures, and revocation lists and OCSP responses grow in step.
A closed network — a tactical link, a satellite downlink, a SCADA segment, an air-gapped enclave, a metering fan-out — changes two things at once, and both favour QuStream. First, you own every endpoint, so pre-provisioning a PDK at manufacture or via a fill device is straightforward; that unlocks QuStream's unconditional one-time-pad tier with no public-key step and no PKI to operate inside the enclave at all. Running a full post-quantum certificate authority inside a constrained or disconnected enclave is precisely the overhead these environments can least afford. Second, many closed networks are intrinsically one-to-many — a command broadcast, a downlink, a multicast control bus — a shape TLS's interactive handshake does not fit but QuStream's broadcast and bounded-storage modes were built for.
Longevity sharpens the point. A weapons platform, a grid controller or a satellite is fielded for twenty or thirty years and cannot be casually re-flashed. A pure-PQC system carries the standing risk of a second migration if lattice cryptanalysis advances — the assumption is young. QuStream's information-theoretic tier carries no such risk: unconditional security has nothing for future mathematics to catch up to, so a system fielded on it does not need to be re-secured against a cryptanalytic break that never threatens it. QuStream native fit for closed, broadcast, constrained, long-life nets; PQC native fit for the open, interactive, PKI-anchored web.
PQC and QuStream are not competing implementations of one idea; they are two philosophies. PQC raises the wall — it keeps TLS exactly as it is and substitutes harder mathematics, betting that the new assumption outlasts the data. That bet is well-placed for the open web: PQC is standardised, drop-in, requires no provisioning, and is being mandated. QuStream removes the wall for the traffic that matters most — its information-theoretic tiers depend on no assumption a computer can defeat, so there is nothing to break and nothing to harvest. The price is infrastructure: provisioned key material or an un-storable broadcast. That price is cheap exactly where the stakes are highest — closed, high-assurance, broadcast, constrained, and long-lived networks — and the two compose cleanly, because a single PQC handshake makes an excellent bootstrap for a link that then needs no further mathematics.
Reach for PQC where the deployment is the open web, the topology is interactive and 1:1, a PKI already exists, no key can be pre-shared, and regulation (CNSA 2.0, FIPS) calls for a standardised drop-in. Reach for QuStream where endpoints can be provisioned or share an un-storable broadcast, where the topology is one-to-many or broadcast, where devices are constrained, where systems are fielded for decades, or where harvest-now-decrypt-later against the highest-assurance traffic must be defeated by construction rather than by assumption. For the strongest posture of all, combine them: bootstrap QuStream with one PQC handshake and trust the mathematics for an instant, not a lifetime.
Post-quantum cryptography secures TLS by swapping vulnerable primitives for lattice- and hash-based ones, keeping the architecture and the PKI but inflating every key, signature and handshake — and resting, still, on a computational assumption that must survive the full lifetime of the data. QuStream derives keys by walking quantum-random material from a single provisioned or bootstrapped secret, carries almost nothing on the wire thereafter, runs on the smallest devices, fits broadcast and one-to-many topologies natively, and offers tiers whose security no future computer can reach. PQC is the right answer for the open web; QuStream is the stronger answer for closed, constrained, broadcast and long-lived networks — and a PQC handshake is the cleanest way to start a QuStream link that, from its first message on, owes nothing more to unbroken mathematics.