NIST-standardized post-quantum cryptography for the web.
Quantum computers will, one day, be powerful enough to break the public-key cryptography that secures most of today's internet. UltimaOS already uses the next generation: NIST-standardised quantum resistant encryption designed to withstand both classical and quantum attacks, deployed by default for every account. Quantum safe encryption is not an upgrade path here — it is the only mode.
Adversaries are already recording encrypted traffic today, intending to decrypt it once a sufficiently powerful quantum computer exists. Any data with a useful lifetime beyond 5 to 10 years is at risk: medical records, legal documents, R&D, customer databases.
After an eight-year competition, NIST published FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) in August 2024. These are the algorithms governments, banks and infrastructure providers are migrating to. UltimaOS adopted them on day one.
RSA-2048 and ECDSA-P256, the public-key workhorses of the current internet, will be broken by a large-scale quantum computer running Shor's algorithm. Migration is not optional — only a question of timing.
UltimaOS uses NIST-standardized lattice cryptography for every public-key operation, paired with classical symmetric primitives that are themselves believed to be quantum-resistant. The result is a hybrid stack where no single algorithm failure compromises the system.
Fresh 256-bit symmetric session keys are encapsulated with ML-KEM-768 (FIPS 203) for every new conversation, file share, and call. The resulting shared secret seeds a symmetric session encrypted with XChaCha20-Poly1305.
Account identities, invitations, device enrollments, and signed audit records use ML-DSA-65 (FIPS 204). Signatures are 1,959 bytes — larger than ECDSA but acceptable for an interactive workspace.
Content inside the end-to-end encrypted envelope — messages, mail, files, notes, tasks, documents and spreadsheets — is encrypted with XChaCha20-Poly1305, an authenticated symmetric cipher. Calendar events and AI conversation history sit outside that envelope today. Symmetric primitives with 256-bit keys have no known quantum speedup beyond Grover's bound.
Software updates are cryptographically signed, and clients verify the signature before applying them.
Post-quantum cryptography is on by default for every account. You do not need to enable anything, install anything, or learn anything. The migration is invisible to the end user.
There is no setting to fall back to RSA or ECDSA. Allowing downgrade would create a downgrade-attack surface where an attacker forces a weaker handshake. Post-quantum is the only mode.
ML-KEM-768 key generation takes about 0.05 ms, encapsulation 0.07 ms. ML-DSA-65 signing is ~0.2 ms, verification ~0.5 ms. The bandwidth cost is a few extra kilobytes per handshake — negligible for a chat/workspace product.
The combination of lattice KEM, lattice signatures, and 256-bit symmetric encryption is expected to remain secure against both classical and quantum adversaries for at least two decades, based on current consensus in the cryptographic community.
Short answer
Post-quantum cryptography refers to cryptographic algorithms designed to resist attacks by both classical and quantum computers. NIST ran an eight-year competition and standardized the first set of post-quantum algorithms (FIPS 203, 204 and 205) in August 2024. (NIST PQC program)
Short answer
Yes. UltimaOS uses NIST-standardized post-quantum algorithms (ML-KEM-768, ML-DSA-65) for all public-key operations and 256-bit symmetric encryption (XChaCha20-Poly1305) for all data at rest. The cryptographic stack is considered safe against both classical and quantum adversaries. (FIPS 203 · FIPS 204)
Short answer
Estimates vary. Conservative projections put a cryptographically-relevant quantum computer at 10 to 20 years away, but some experts argue sooner given recent breakthroughs. The safe assumption for any data with a multi-year lifetime is that the threat is already relevant — the harvest-now-decrypt-later attack model.
Short answer
The EU has identified quantum-safe cryptography as a strategic priority through the EuroQCI program and the EU Cybersecurity Strategy. Member-state CSIRTs and infrastructure providers are mandated to migrate to post-quantum algorithms in the coming years.
Short answer
The algorithms are NIST-standardized with public specifications, so the cryptographic design can be verified independently against those specs. The client ships to your browser as a standard single-page app, so the code that runs can be inspected directly in developer tools — inspectable today, with signed reproducible builds on the roadmap to make it mechanically verifiable. The backend is proprietary; you can interrogate its behaviour from inside uOS via uAI.
Short answer
Negligibly. Post-quantum key exchange adds a few milliseconds at the start of a conversation and a few kilobytes of network traffic. Day-to-day use is indistinguishable from classical cryptography.
Short answer
Lattice-based cryptography has been studied for over 25 years with no significant breaks. If a fundamental break is ever discovered, UltimaOS would migrate to a new algorithm — and the security disclosure page would document the process publicly.
Short answer
UltimaOS follows NIST standards as published and tracks IETF standardization (the pq-crypto and tls working groups), building on the community-reviewed cryptographic implementations of those standards.
Short answer
They describe the same goal with different words. "Quantum proof encryption", "quantum resistant encryption" and "quantum safe encryption" are informal terms for what NIST standardised as post-quantum cryptography: algorithms believed to hold against an adversary with a large-scale quantum computer. UltimaOS uses the standardised ones — ML-KEM-768 (FIPS 203) and ML-DSA-65 (FIPS 204) — rather than anything bespoke.
No ads, no data mining, no trial clock. Individual and family accounts are free — permanently. Organisations pay per seat, and that is what funds it.