NetSfere Launches Quantum-Resilient Messaging Platform for Enterprise and Government Use – Source: www.securityweek.com

Communications services provider NetSfere has upgraded its platform to use a combination of NIST recommended and NSA required ML-KEM and AES algorithms.

The NSA has specified, “CNSSP 15 states that by January 1, 2027, all new acquisitions for National
Security Systems (NSS) will be required to be CNSA 2.0 compliant unless otherwise noted.” Removing the less common acronyms, this says the encryption policy wonks at the NSA require most government agencies, military and intelligence operators and sectors of the critical infrastructure should only be able to buy new services or products that are NIST PQC compliant within less than two years from now.

While the organizations themselves have until 2035 to complete their migration to NIST standard quantum-resilient encryption, vendors wishing to sell their goods into the NSS market have only until January 1, 2027, to ensure their products already employ NIST standard PQC.

We are seeing, and will increasingly see, new product announcements stressing their PQC creds. On March 18, 2025, HP announced new quantum ready printers. On March 24, 2025, NetSfere announced “the world’s first and only quantum-proof secure communication platform”. It is primarily the company’s existing communication platform upgraded to quantum-readiness and therefore available to the NSS market both now and after 2027.

Within the platform, NetSfere has put special emphasis into its end-to-end encrypted messaging able to handle text, voice and video. The firm sees mobile chats increasingly emerging from personal comms into a major part of business communication, and it offers the enterprise a way to incorporate mobile messaging into the organization in a secure and manageable format.

The key factor is that this is true end-to-end encryption with quantum ready algorithms. Keys are shared from source to destination, using FIPS 203 ML-KEM (Kyber). The message is encrypted with AES 256, which – while not a new symmetric algorithm – is considered by NIST to be quantum resistant.

NIST also urges that crypto agility be built into the migration to QPC. It is the nature of cryptographic algorithms to sooner or later be broken. For example, in August 2022, it emerged that one of the finalists in NIST’s competition to find new quantum-proof algorithms had already been broken by a combination of AI and a classic PC.

Crypto agility requires that if the algorithm in use is broken or fails for any reason, it can be easily swapped out for an alternative (unbroken) algorithm. Right now there is no standardized quantum proof key encapsulation mechanism available as a backup to ML-KEM, although HQC has been chosen by NIST to become one.

“We don’t believe that ML-KEM is going to be broken anytime soon,” Anurag Lal, CEO at NetSfere, told SecurityWeek. “But the good news is that we built NetSfere with a crypto agile platform, allowing us to move from one algorithm to another efficiently and seamlessly. So, if there is ever a need to swap out ML-KEM and an alternative to swap in – whether it is HQC or anything else – we are confident that we have the agility to do that.”

The NetSfere platform is a ‘product’ paid for, and therefore loosely ‘owned’ by, individual companies. This provides numerous advantages to both the users and NetSfere. For example, platform management is controlled by the customer, not by the provider. This allows versatility and flexibility – for example, in the use of MFA. Most delivery of one-time MFA is via a mobile device. This can be problematic for secure mobile messaging. If the phone is stolen, the attacker has access to both the means of communicating, and the one-time code that supposedly proves he is the genuine user. NIST has gone further and deprecated the use of SMS to deliver MFA at all.

NetSfere offers delivery by email, which – done properly – could be more secure. But it may not be realistic or efficient for a traveling businessperson needing a quick and urgent response from the office. So, NetSfere still offers the choice of MFA sent direct to the phone (SMS). The choice is a risk management decision, but one made and implemented by the company – on demand – rather than by NetSfere.

Another advantage of user ownership for both the user and NetSfere is that each company owns, keeps and is responsible for its own encryption keys. NetSfere never sees the keys and cannot be forced or persuaded to hand over what it hasn’t got to law enforcement. While this approach ensures true end-to-end encryption, it also counters the current problem of individual national governments demanding a backdoor into that end-to-end encryption. 

The UK government, for example, has required Apple (under the Investigatory Powers Act) to give backdoor access for data encrypted between the user and iCloud. The Apple service is called Advanced Data Protection (ADP). Rather than provide the keys or a backdoor, Apple has discontinued its ADP service for the UK – a solution that benefits no-one.

If a similar situation arose between any government and NetSfere, the firm could reply, “We don’t have the keys, we don’t own them, they are owned and kept by the customer. If you have a legal right to demand the keys from the customer, just do so.” This should keep most people happy: there is no requirement for a backdoor, while law enforcement can still get legal access.

NetSfere has announced a quantum-proof, end-to-end encrypted enterprise messaging system that is administered by the enterprise. It is primarily designed for in-company communications but can also be used for secure messaging to outsiders. Its purpose is to combine the business use and advantages of mobile messaging with maximum security. During 2025, we will see more and more providers rapidly implementing the use of quantum proof cryptography in both new and existing products to secure their users and maintain the option of selling into the huge NSS market from 2027.

Related: What Microsoft’s Majorana 1 Chip Means for Quantum Decryption

Related: QuSecure Banks $28M Series A for Post-Quantum Cryptography Tech

Related: Cyber Insights 2025: Quantum and the Threat to Encryption

Related: Post-Quantum Cryptography Standards Officially Announced by NIST – a History and Explanation