Post-Quantum Cryptography from Collatz Labs ships in two deployment modes — Hybrid, which runs classical and post-quantum algorithms side by side, and Pure, which replaces classical primitives outright. zkAssess's findings tell you which one fits which system.
Both modes ship from the same codebase, get the same side-channel hardening, and get matched to your systems by zkAssess's findings — not chosen blind.
A session key derived from both a classical algorithm and ML-KEM at once — an attacker has to break both. The right call for public-facing infrastructure and anything that has to keep working with clients that don't support post-quantum yet.
See how Hybrid works →RSA, ECDSA, and Diffie-Hellman replaced outright with NIST-standardized post-quantum algorithms. The right call for new systems and internal infrastructure with no legacy compatibility constraint.
See the algorithm suite →A hybrid handshake runs a classical algorithm (like ECDH/X25519) and a post-quantum one (ML-KEM) in parallel, then derives the session key from both. An attacker has to break both the classical and the quantum-resistant algorithm to read the traffic — not just one.
Of human-initiated web traffic through Cloudflare already uses post-quantum hybrid key agreement.
Cloudflare, Google Chrome, and Apple iMessage have all shipped hybrid post-quantum key exchange to production.
Classical compatibility lost — hybrid mode keeps working with clients that don't yet support Post-Quantum Cryptography.
Lattice-based algorithms like ML-KEM are mathematically strong enough to resist both classical and quantum attacks. But a device executing that math still draws power and emits electromagnetic signals while it runs — and an attacker who can measure that physical "exhaust" can sometimes recover the secret key without ever attacking the math itself.
Pure Post-Quantum Cryptography replaces every quantum-vulnerable primitive outright, using the algorithms NIST finalized in August 2024 — not a placeholder waiting for a future standard.
Module-lattice key encapsulation — replaces RSA and ECDH for key exchange and encryption.
Module-lattice digital signatures — replaces RSA and ECDSA/EdDSA for signing and authentication.
Hash-based signatures — a conservative fallback with a different mathematical foundation than the lattice-based pair above.
CNSA 2.0's procurement gate for new national security systems opens January 2027 — new builds are the moment to go pure, not retrofit later.
Legacy clients to carry forward — new systems and internal infrastructure you fully control don't need a classical fallback.
Cryptographic stack to maintain going forward, instead of two algorithms running in parallel indefinitely.
With no classical fallback, Pure's signature and key-exchange operations are the only thing standing between an attacker and your keys. Signature schemes like ML-DSA carry their own side-channel exposure, distinct from ML-KEM's.
This is the same choice enterprises deploying Post-Quantum Cryptography today are actually making.
| Consideration | Hybrid | Pure |
|---|---|---|
| How it works | Classical (e.g. ECDH) and post-quantum (ML-KEM) run side by side; a session breaks only if both fail. | Quantum-resistant algorithms replace classical ones outright — no classical fallback. |
| Best fit | Public-facing infrastructure and systems that must stay compatible with clients that don't support post-quantum yet. | New systems, and regimes such as CNSA 2.0 that plan to require quantum-resistant-only algorithms. |
| Who's shipped it | Cloudflare, Google Chrome, and Apple iMessage already run hybrid key exchange in production. | Expected as the endpoint of most migration roadmaps once compatibility constraints are gone. |
| Side-channel exposure | ML-KEM decapsulation — power/EM leakage, FO-transform exposure, timing variance. | ML-DSA signing — signing-time leakage, nonce exposure, no second algorithm as a backstop. |
| Trade-off | Larger handshake sizes and two algorithms to maintain, in exchange for a safer transition. | Simpler long-term footprint, but no fallback if a client or dependency can't yet support it. |
Hybrid is the right call for public-facing infrastructure and any system that has to keep working with clients that don't support post-quantum algorithms yet — exactly the systems zkAssess's scan surfaces as quantum-vulnerable but still client-constrained.
Where a system doesn't have that constraint — new services, internal infrastructure with full control over both ends — Pure is usually the better long-term fit. Most organizations don't choose once; they choose per system, and both paths get the same side-channel protections either way.
See the full suite and start with what fits your systems today.