SuperQubit unifies post-quantum cryptography, terrestrial quantum key distribution, and satellite QKD into a single vendor-independent fabric — and delivers secure access to quantum computation across the same protected channels. No application changes required.
Two distinct networks coexist: the classical fabric we already use, and the quantum channels that distribute keys no future cryptanalysis can compromise.
The classical internet carries every encrypted payload today. SuperQubit upgrades it in place: a PQC bridge for legacy systems, crypto-agile primitives for everything new. ML-KEM for key establishment, ML-DSA-87 for authentication and origin verification — composable in hybrid mode with RSA and ECC during migration, then pure PQC.
Quantum channels over metropolitan and regional fiber. BB84 and decoy-state protocols generate symmetric key material whose secrecy is guaranteed by physics, not by computational hardness. Trusted-node relays bridge distance limits until quantum repeaters mature.
Where fiber cannot reach — between continents, across oceans, into denied environments — satellite payloads distribute quantum keys via free-space optical links. Ground nodes in Layer 2 then carry that key inward, completing an end-to-end information-theoretic backbone.
Customers declare per-application — or per-byte — which security guarantee applies. The platform logs the mode used for every session, so auditors can verify it.
The classical network carries everything. Key exchange via ML-KEM, authentication via ML-DSA-87, symmetric encryption via AES-256. For traffic where a 10–15 year confidentiality horizon is sufficient.
Quantum-distributed keys feed AES-256 over the classical bearer. The session key cannot be retrospectively compromised even if the asymmetric primitives are broken in the future. Authentication remains in Layer 1.
Key material distributed by QKD equals plaintext volume. No algorithm, classical or quantum, can recover it. Reserved today for diplomatic, root-credential, and lifetime-classified traffic; scales as key rates climb.
QKD cannot authenticate. Every quantum channel is bootstrapped and re-keyed over a PQC-authenticated classical control plane.
An application’s sensitivity tag chooses its mode. The middleware enforces it transparently — no developer involvement required.
Every session emits a signed record: which mode, which key source, which primitives, which layer. CISO and regulator ready.
A single middleware layer recognises which application is talking to which, selects the appropriate mode and layer, and applies encryption — without modifying the application.
policy engine
Drop in as a PKCS#11 module, OpenSSL provider, or service-mesh sidecar. Existing software keeps working — now post-quantum and QKD-capable.
Speaks ETSI GS QKD 004/014 to any QKD vendor — Toshiba, ID Quantique, QuantumCTek, KETS. No platform lock-in.
When Falcon finalises, when SPHINCS+ parameter sets shift, when new primitives land — swap them in via policy, not deployment.
The same fabric that protects communication also protects quantum job submission. Customer inputs and proprietary algorithms travel the SuperQubit network end-to-end.
Customers submit problem instances through the SuperQubit platform. We compile them against our proprietary quantum algorithms — methods we have developed and do not share — and execute them on the most appropriate hardware backend available, whether that is our partners’ or our own.
Job inputs, intermediate states, and outputs travel the secure communication fabric described above. The mode is the customer’s choice — including blind-delegation protocols for problems where the algorithm itself must remain confidential to the operator.