# AI, quantum, mechanism and key

### Why we treat AI as an accelerator and quantum as the real change

**The rule is old.** Kerckhoffs' principle (1883): a system must stay secure when everything about it except the key is public. We build to that rule: every protocol and source file is open and handed to the customer; the only secret is the key — from a vetted random source, bound to hardware, never shown to a human. Hiding the mechanism (rotating URLs, timing jitter) buys delay and detection, never security.

**What AI changes.** AI makes attacker and defender faster at the same rate. It does not change the work factor of a sound key mechanism, but it finds flaws faster — weak randomness, implementation errors, misconfigurations — and scales phishing and deepfakes. A mechanism that relied on staying secret therefore falls sooner; a public, battle-tested one does not. So we test our protocols in the open, in licence-free integrations for private users, before they carry sensitive data, and answer AI with resilient people and implementations: hardware-bound keys with nothing a person could disclose, liveness beyond a face on a screen, authorisation on current data, fail-closed behaviour. Not longer keys.

**What quantum changes.** Quantum computing attacks the key — and through it today's public-key algorithms: a cryptographically relevant quantum computer derives RSA and elliptic-curve private keys from public keys at any practical length, so those algorithms must be replaced, not lengthened. AES-256 remains safe. Traffic recorded today can be decrypted then — harvest now, decrypt later — so the risk is already running. The industry is moving: in 2025 over a third of web traffic on one of the largest networks already used hybrid post-quantum key agreement; public certificate lifetimes are being cut to 47 days by 2029.

**What we do about it.** Keys are hardware-bound (FIDO2, secure element) and ephemeral: fresh per session, ratcheted, never persistent. Key exchange follows a hybrid path (ML-KEM next to X25519), post-quantum signatures the same path, and every algorithm is negotiated per session so one can be replaced without redesigning the protocol. Certificates, where they remain, live for hours and are swapped every few minutes (see the M2M and certificate-management page). We call this **quantum-ready — designed for the post-quantum era**. Nobody can honestly promise more.

**Where AI runs.** Two places, kept apart. In the product, an AI engine inspects redundant transaction outcomes and telemetry for anomalies, inside your own deployment on your hardware — we hold none of your data. In our own engineering, AI reviews designs and code; anything sensitive or top secret in our classification goes only to models we run ourselves, never to a cloud model.

*Wols CA — security architecture for sensitive and top-secret assets. Industry figures as of 2025.*