Security: PQC Hybrid Cryptography
Relevant source files
The following files were used as context for generating this wiki page:
Security: PQC Hybrid Cryptography represents the core defensive layer of the TAMV Online ecosystem, specifically integrated into the DEKATEOTL security system and the MD-X kernel. This framework implements Post-Quantum Cryptography (PQC) alongside classical cryptographic methods to ensure "Zero-Trust" security and long-term resistance against potential quantum computing threats.
The system utilizes hybrid signatures and encryption schemes, primarily leveraging algorithms like Kyber for key encapsulation and Dilithium for digital signatures. This hybrid approach ensures that the infrastructure remains secure against current classical attacks while preparing for the post-quantum era, protecting the sovereignty of digital identity and territorial data within the Digital Nexus.
Sources: src/pages/wiki/metaverso-xr/DekateotlSeguridad.tsx:8, federation/tamv-digital-nexus/packages/contracts/openapi/tamv.v1.yaml:18-28, src/pages/wiki/modulo-cero/Introduccion.tsx:69-72
DEKATEOTL Security Framework
The DEKATEOTL system is a 11-layered biological and digital security model. PQC Hybrid Cryptography serves as the fourth layer of this multicapa system, specifically handling quantum anomaly detection and post-quantum encryption.
Core Security Layers
The cryptographic implementation is situated within a broader "Zero-Trust" model where no component implicitly trusts another.
| Layer | Component | Function |
|---|---|---|
| 3 | Quantum Anomaly Detection | Identifies non-classical patterns in traffic |
| 4 | Post-Quantum Cryptography | Implementation of Kyber and Dilithium algorithms |
| 9 | Continuous Auditing | Persistent verification of cryptographic integrity |
| 11 | Self-Healing | System-wide recovery from cryptographic failures |
Sources: src/pages/wiki/metaverso-xr/DekateotlSeguridad.tsx:8-12, src/pages/wiki/fundamentos-isni/ConceptosClaveISNI.tsx:40
Cryptographic Implementation
The PQC implementation in TAMV is standardized through the QuantumSecurityLayer™. This layer is responsible for generating hybrid key pairs and managing signatures for the unified API.
Hybrid Algorithms
The system specifically defines the use of the following NIST-standardized post-quantum algorithms:
- ML-KEM (Kyber): Used for secure key encapsulation and encryption.
- ML-DSA (Dilithium): Used for digital signatures (specifically Dilithium3 and Dilithium5 variants).
- SLH-DSA: Part of the hardening roadmap for stateless hash-based signatures.
Sources: federation/tamv-digital-nexus/packages/contracts/openapi/tamv.v1.yaml:126-150, src/pages/wiki/metaverso-xr/RoadmapCivilizatorio.tsx:162-166
Authentication Flow
The system utilizes a specialized QuantumToken scheme. This is a JWT (JSON Web Token) enhanced with a post-quantum signature using the Dilithium3 algorithm, allowing for verification that is resistant to quantum computing decryption.
The diagram above shows the process of upgrading standard authentication to the QuantumToken standard.
Sources: federation/tamv-digital-nexus/packages/contracts/openapi/tamv.v1.yaml:63-75
API Architecture for PQC
The API exposes specific endpoints for managing the lifecycle of quantum-resistant keys and signatures. These services are classified under Pipeline A - Critical Operations.
Security Service Endpoints (Port 8002)
| Endpoint | Method | Description |
|---|---|---|
/security/hybrid-key | POST | Generates a new QuantumKeyPair containing both Dilithium and Kyber public keys. |
/security/sign | POST | Signs a specific payload using a provided key_id and the Dilithium algorithm. |
/security/verify | POST | Verifies a Dilithium signature against a payload and public key. |
Sources: federation/tamv-digital-nexus/packages/contracts/openapi/tamv.v1.yaml:12-18, federation/tamv-digital-nexus/packages/contracts/openapi/tamv.v1.yaml:318-378
Key Data Structures
The QuantumKeyPair structure is the foundation of the hybrid identity. It links a unique key_id with post-quantum public keys and expiration timestamps.
{
"key_id": "qsl-1709564400000-abc123",
"public_key_dilithium": "string",
"public_key_kyber": "string",
"created_at": "date-time",
"expires_at": "date-time"
}
Sources: federation/tamv-digital-nexus/packages/contracts/openapi/tamv.v1.yaml:126-138
Integration with MD-X Kernel
PQC Hybrid Cryptography is integrated into the MD-X4 and MD-X5 kernels through the SEC (Security) federation. This federation ensures that all data persistence (MSR/BookPI) and inter-service communication are protected by quantum-resistant layers.
Security Posture and Federated Repositories
The system maintains a specific "Security Posture" monitored via the /v1/security/posture endpoint. This allows the orchestrator to track the health of the PQC implementation across all 195 federated repositories.
The sequence shows how the SEC federation interacts with the PQC layer to ensure the immutability of the Master Sovereign Record.
Sources: README.md:43-45, src/pages/wiki/fundamentos-isni/ConceptosClaveISNI.tsx:12-16, src/pages/wiki/modulo-cero/Introduccion.tsx:69-72
Summary
Security: PQC Hybrid Cryptography provides the necessary "Zero-Trust" infrastructure to protect TAMV Online against the future of quantum computation. By implementing NIST-standardized algorithms like Kyber and Dilithium within the DEKATEOTL framework and the MD-X kernel, the project ensures that digital identities and territorial sovereignty remain uncompromised. The system is currently functional for staging and pilots, with ongoing hardening directed towards a full production-ready status.
Sources: README.md:104-106, src/pages/wiki/metaverso-xr/RoadmapCivilizatorio.tsx:210-214