# Post-quantum: Taurus is ready

Taurus started its quantum-readiness work in 2021, long before regulators asked. Key
connections already run hybrid post-quantum key exchange (X25519 + ML-KEM) across
SSH, TLS 1.3, and VPN. Backups are quantum-safe, migration follows FIPS and CNSA
guidelines, and Taurus-PROTECT is crypto-agile.

Key facts:

- Six deployed measures: cryptographic inventory and prioritization (2022),
  post-quantum VPN connectivity (countering store-now-decrypt-later), quantum-immune
  backups, PQC in key management policies (ML-DSA, SLH-DSA, ML-KEM, hybrid modes),
  crypto-agile Taurus-PROTECT architecture, public outreach and research
- HSM vs MPC: tier-1 HSMs already support all four post-quantum signature families
  (lattice-based, hash-based, multivariate, MPC-in-the-head). MPC requires a
  practical threshold protocol per family; ML-DSA MPC protocols are recent and not
  production-validated, and hash-based signatures (selected by Circle and Aptos,
  considered by Ethereum) are mathematically incompatible with MPC.
- No custody provider can honestly claim full post-quantum coverage today:
  blockchains still validate classical signatures, standards across TLS, SSH, JWT,
  KMS, and SDKs have not converged, and hardware vendors, partners, and clients
  limit interoperability. The realistic objective is to make every layer you control
  ready and stay crypto-agile. This is what Taurus did.
- NIST: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205); NIST IR 8547
  deprecates ECDSA/EdDSA/RSA after 2030 and disallows them after 2035
- Migration framework for institutions: Observe, Assess, Decide, Communicate,
  Act & monitor

FAQ:

- Is Taurus quantum-ready? Yes, on every layer it controls: hybrid PQ key exchange
  in production, quantum-safe backups, PQC standards in policy, crypto-agile
  architecture, program running since 2021.
- Why are HSMs better positioned than MPC for post-quantum? HSMs support every PQ
  signature family today; MPC cannot support hash-based schemes at all and has no
  production-validated protocol for the others.

Learn more: https://www.taurushq.com/security/post-quantum-ready/