Atsign Adds NIST Post-Quantum Cryptography to Its SDKs
Atsign announced that it has integrated NIST-approved post-quantum cryptography (PQC) into the SDKs supporting its platform, according to a company press release on August 27. The vendor states that developers can adopt this protection without rewriting their applications.
Atsign’s delivered features
Specifically, the company has incorporated the algorithms standardized by NIST in 2024 (published as FIPS 203, 204, and 205) into its core SDKs. Atsign highlights three ways to utilize this update: developing new applications with the SDKs, retrofitting existing applications, and securing systems unmodifiable via its NoPorts service. Indeed, NoPorts provides encrypted access to existing services without exposing inbound ports, and this update extends post-quantum protection to these connections, even if the underlying legacy system remains unchanged.
Atsign emphasizes its open development process, with its roadmap and code available on GitHub. This transparency is a crucial aspect, as using NIST-standardized algorithms and making the work publicly accessible is characteristic of serious post-quantum cryptography adoption, unlike proprietary schemes marketed as unbreakable.
CEO Aparna Rayasam commented on the release:
“At its core, this integration makes anything built on our platform quantum-safe by default. Achieving post-quantum readiness shouldn’t require multi-year application overhauls. By embedding NIST-approved algorithms directly into our SDKs, we’re delivering true crypto agility so engineering teams can focus on innovation rather than complex cryptographic mechanics.”
Claims requiring verification
The assertion of being “quantum-safe by default” hinges entirely on correct implementation. Standardized algorithms can’t protect a system if they’re called incorrectly, keys are mishandled, or if fallback paths to older cryptographic methods exist. For legacy systems accessed through NoPorts, Atsign protects the connection and data flow, but not the system itself, as its own description clarifies. This provides mitigation at the transport layer, but it’s not a complete migration of the underlying application.
Currently, no cryptographically relevant quantum computer exists. The threat Atsign addresses is “harvest-now-decrypt-later,” where attackers store encrypted data today with the intention of decrypting it once capable hardware becomes available. The press release mentions an expectation for machines capable of breaking today’s asymmetric algorithms in the early 2030s; this is a projection, not a definitive timeline.
The customer testimonial from NeuroVitals and the comparison to Google’s 2029 transition timeline are derived from the press release and describe intentions rather than independently verified results. For readers, the key takeaway is specific: one vendor has integrated standardized PQC into its tools and openly shared its work. The extent to which this translates into protected deployments will depend on how customers implement it.