RFC 8784 post-quantum preshared key IKEv2: how it works
A technical guide to RFC 8784 post-quantum preshared keys in IKEv2: what a PPK protects, where it falls short, how it compares with RFC 9370 and ML-KEM, and how to generate, distribute...
Quantum-safe data centre replication encryption explained
Replication links copy your most valuable data between sites every day, which makes them a prime harvest now, decrypt later target. This article covers hybrid ML-KEM, throughput, MACsec versus IPsec, key rotation...
Firewall TLS inspection and post-quantum key exchange
Hybrid ML-KEM key exchange makes the TLS ClientHello larger and adds new group codepoints. This article covers why middleboxes drop these handshakes, how inspection affects them, and how to test before rollout.
Post-quantum VPN fragmentation MTU: why tunnels fail
ML-KEM public keys and ciphertexts are many times larger than ECDH values, and that pushes VPN handshakes past the path MTU. This article covers the byte sizes, how IKEv2 fragmentation works, why...
Post-quantum IKEv2 ML-KEM: how does it work?
A technical explainer of post-quantum IKEv2 with ML-KEM for OT and critical infrastructure networks. It covers RFC 9370, RFC 9242, hybrid versus standalone ML-KEM, Child SA rekeying and the IETF standardisation status.
Encryption gateway in front of or behind firewall?
Placement decides what your firewall can inspect. This guide covers in-front versus behind placement, firewall rules, NAT, DMZ and segmentation, and the routing changes needed to add quantum-safe encryption to OT and...
How to encrypt traffic between sites over the internet
A guide for OT and critical infrastructure teams: how site-to-site encryption works over the public internet, why classical key exchange is a long-term exposure, where ML-KEM (FIPS 203) fits, and how to...