Post-quantum TLS termination
Hybrid key exchange groups such as X25519MLKEM768 protect every client connection.
Application & API Layer
Elvas QGate
Quantum-Safe API Gateway
Defends APIs from interception, impersonation and token forgery. QGate terminates post-quantum TLS 1.3 at the edge and enforces ML-DSA-based identity, protecting existing APIs and microservices without any change to their code.
listener:
port: 443
tls:
min_version: "1.3"
groups: [X25519MLKEM768, SecP256r1MLKEM768]
certificate: ml-dsa-65+ecdsa-p256 # hybrid
routes:
- match: /api/payments/*
upstream: https://payments.internal
mtls: required
jwt: { verify: ml-dsa-65 }
rate_limit: 500r/sOverview
The problem QGATE solves
APIs carry an organisation's most sensitive transactions: payments, identities, health records and machine-to-machine commands. They are protected by TLS key exchanges and token signatures that a quantum computer will break, and they sit on systems that are too costly or risky to rewrite.
Threats mitigated · MITRE ATT&CK
T1557Adversary-in-the-middleT1550.001Access token abuseT1606Forge web credentials
Technical specifications
- TLS key exchange
- X25519MLKEM768, SecP256r1MLKEM768
- Identity
- ML-DSA mTLS, hybrid X.509 certificates
- Tokens
- PQ-signed JWT / JWS (ML-DSA)
- Protocols
- HTTP/1.1, HTTP/2, gRPC, WebSocket
- Deployment
- Edge appliance, container, Kubernetes ingress
- Fallback
- Policy-controlled hybrid / classical negotiation
Architecture
Gateway architecture
Capabilities
Built for security teams, engineered for scale
PQ mutual TLS
Client and service identities are issued as ML-DSA or hybrid certificates.
Quantum-safe tokens
JWT / JWS signed and verified with ML-DSA for API authorisation.
Zero-change adoption
Legacy upstream services stay as they are while the gateway handles the cryptographic migration.
Policy enforcement
Per-route mTLS, token, rate-limit and allow-list policies, with full audit logging.
Observability
Handshake, policy and anomaly events exported for monitoring and SIEM correlation.
Use cases
Where QGATE protects you
Open banking & payments
Protect partner and customer APIs that carry high-value financial transactions.
Legacy modernisation
Make mainframe and monolith APIs quantum-safe without touching their code.
Machine-to-machine
Secure service mesh and IoT traffic with PQ identities and short-lived tokens.
See Elvas QGate in action
Book a technical demonstration with our engineers and discuss your deployment.