QuSecure’s post-quantum security platform reached technology readiness level seven (TRL 7) after soldiers used it to protect and monitor tactical mission systems during a U.S. Army field exercise.

QuProtect R3 met the TRL 7 criterion of demonstrating a system prototype in an operational environment. The Army’s Command, Control, Communications, Computers, Cyber, Intelligence, Surveillance and Reconnaissance Center (C5ISR Center) confirmed the assessment; QuSecure product manager Joey Lupo told SDxCentral.

The Army has not permitted QuSecure to identify the mission systems involved. However, the platform protected about 10 data connections using its QuProtect Resilience component, while QuProtect Reconnaissance continuously monitored more than 50 systems.

The deployment took place during Project Convergence Capstone 6 at the National Training Center in Fort Irwin, California. The 10-day experiment brought together about 10,000 U.S. and allied industry participants to test more than 90 technologies, concepts, and formations under operational conditions.

Switching cryptography without downtime

QuProtect secured communications using a post-quantum version of transport-layer security (TLS), with the Commercial National Security Algorithm (CNSA) 2.0-compliant module-lattice-based key-encapsulation mechanism (ML-KEM)-1024 algorithm used for key establishment. Some connections used mutually authenticated post-quantum TLS, requiring both parties to authenticate themselves.

The platform protected live traffic, discovered and inventoried existing cryptography, and applied an Army-specific policy to evaluate that inventory and enforce consistent protection across different mission systems.

During the exercise, QuSecure switched key establishment from the hybrid X25519MLKEM768 mechanism, which combines classical and post-quantum cryptography (PQC), to ML-KEM-1024 alone. The change did not require application restarts or downtime, and certificates were also rotated automatically on a defined schedule.

QuProtect maintained uptime throughout the exercise, though it did not provide field measurements for latency or throughput, only stating that earlier laboratory testing with the C5ISR Center found its effect on both was negligible.

“In TLS, all the PQC happens at session initiation time and then the bulk data for the session is protected using symmetric encryption, which is unchanged from non-PQ TLS to PQTLS,” Lupo said.

QuSecure targets NGC2 integration

The trial follows almost two years of development with the C5ISR Center under a Phase II Small Business Innovation Research project. The Army selected QuSecure in September 2024 for its “Enhanced Post-Quantum Cryptography Suite for Tactical Networks” project.

QuSecure is now incorporating feedback from soldiers to simplify the platform’s deployment and integration with existing tactical network architecture.

The company is also working with the C5ISR Center to incorporate QuProtect into the Army’s Next Generation Command and Control (NGC2) architecture, which was the central focus of Capstone 6 and is intended to connect data and software across war-fighting functions to help commanders more quickly make decisions.

QuSecure said the integration work would make cryptographic agility and post-quantum protection foundational elements of the Army’s future network architecture.

The work comes as federal agencies face new migration deadlines under Executive Order 14412. The order calls for standardized post-quantum cryptography (PQC) to be used for key establishment by the end of 2030, and digital signatures by the end of 2031.