How to Read This Document
You have likely been handed many "post-quantum" security decks this procurement cycle. The majority of those decks ask you to trust a proprietary algorithm, a vendor's internal audit report, or a certification that expires before your data risk does. This document operates on a different premise: every claim is falsifiable from your own Linux terminal, without vendor involvement, before you sign anything.
03 — The Constant
Whether a security platform can reach into your estate is not a policy question — it is a question about what is in the code.
05 — The Evidence
This section gives you the exact byte length of the signature and tells you how to measure it yourself in thirty seconds.
06 — The 3 A.M. Scenario
The real attack on encryption is entropy exhaustion. This section is the replayable test of what the system does when it fails.
The Three Questions Your Board Asks
The Board Asks
Are we exposed to Harvest Now, Decrypt Later?
The Loop
What CQWS Delivers
Information-Theoretic Security via OTP: mathematically impossible to decrypt even with quantum compute.
The Board Asks
Can we protect data without collapsing the network?
The Loop
What CQWS Delivers
Gigabit wire-speed throughput via Ring-0 kernel hook; verified with automated iperf3 benchmarks.
The Board Asks
Can we prove it works to our auditors?
The Loop
What CQWS Delivers
Independent NIST SP 800-22 STS battery script; Shannon Entropy > 7.999 bits/byte on live traffic.
What CQWS Cannot Do (The Permitted / Prohibited Matrix)
The Platform MAY
- ENCRYPTOutbound TCP payloads using Pauli-matrix OTP logic before they leave the kernel.
- DROPInbound packets that fail the ZTNA Dilithium stealth authentication check at Ring-0.
- INTERCEPTLayer 7 application-layer attack patterns (e.g. SQL injection) via the WAF operating at Ring-0.
- MEASUREInbound connection rates and trigger automatic connection throttling for DDoS mitigation.
The Platform MAY NOT
- EXFILTRATESend cryptographic key material, packet contents, or telemetry off the server to any external endpoint.
- TERMINATEKill, suspend, or modify any user-space process or system service.
- LOCKOUTDisable, modify, or query any Active Directory account, Kerberos ticket, or user credential.
- COMMUNICATEInitiate any outbound connection to a vendor server, licensing authority, or analytics endpoint.
The Hybrid Entropy Pool
CQWS does not trust any single source of randomness. The hybrid_entropy_mix() function XOR-combines four independent entropy sources before any OTP key material is derived. Even if three sources are completely compromised, the output remains cryptographically secure.
1. Host OS CSPRNG
Linux /dev/urandom — ChaCha20 DRBG seeded from kernel entropy pool.
2. CPU Hardware
Intel RDRAND / RDSEED — hardware RNG built into CPU, sourcing thermal noise.
3. Interrupt Timing
Nanosecond-resolution measurement of CPU interrupt arrival timing (jiffies).
4. Quantum Dice DISC™ QRNG
Dedicated Quantum Random Number Generator sourcing from quantum photonic shot noise.
The 3 A.M. Scenario (Fail-Closed Architecture)
Reconnaissance Scan Begins
Adversary's nmap runs against the server's IP range, probing all 65,535 TCP ports.
ZTNA Stealth Hook intercepts. Packets lack ML-DSA-65 signature. Dropped at Ring-0. No TCP ACK or RST.
Traffic Amplification
Adversary sends high-volume spoofed UDP traffic to exhaust the server's entropy pool.
Hybrid pool monitors real-time health. Network throughput on authenticated connections begins to throttle.
Entropy Pool Critical
Entropy pool drops critically low. Genuine OTP key quality cannot be guaranteed.
CQWS severs active connections rather than encrypting with a degraded key. Network connectivity is interrupted safely.
Entropy Recovery
Quantum Dice DISC™ QRNG and RDRAND sources reseed the pool. CQWS resumes normal operation.
Network connectivity restores. Graceful Degradation event is logged with start time, duration, and entropy floor value.
Verify It Yourself (The Commands)
| Command / Action | Verified Property | Expected Result |
|---|---|---|
cat cqws_ultimate.c | The Constant | A single C source file. No socket() calls to external endpoints, no persistent key storage. |
cat cqws_ultimate.c | grep memzero_explicit | Key Destruction | memzero_explicit() appears at every site where OTP key material is consumed in encryption loop. |
Wireshark Capture | Post-Quantum Auth | Signature payload: exactly 3,309 bytes. Matches NIST FIPS 204 ML-DSA-65 specification. |
nmap <server_ip> | ZTNA Stealth Hook | All ports report as filtered (no response). Server appears not to exist to scanning host. |
./CQWS_NIST_Auditor.sh | Entropy Quality | Shannon Entropy > 7.999 bits/byte across all 15 NIST SP 800-22 STS tests on live traffic sample. |
Glossary of Terms
CRQC
Cryptographically Relevant Quantum Computer. A quantum computer of sufficient scale and error-correction to run Shor's algorithm against RSA-2048 in practical time.
Information-Theoretic Security (ITS)
Security that holds regardless of the computational power of an adversary. Distinct from computational security. OTP provides ITS.
memzero_explicit()
A Linux kernel function that zeroes a memory region and is guaranteed by the compiler not to be optimised away.
MLWE (Module Learning With Errors)
The mathematical hardness assumption underlying CRYSTALS-Dilithium (NIST FIPS 204). No known efficient quantum algorithm exists for MLWE.