Post-quantum public key infrastructure, measured.
GreenPhysics builds and operates post-quantum PKI and publishes the evidence: a book, eighty-seven numbered findings, and the apparatus that produced them — free, under the Apache License 2.0. No claim without its experiment.
Get the apparatus The book Read the findingsWhat was proved
A post-quantum CA in the cloud, from an empty account
Declared in Terraform, pinned by digest, built live: seven resources, one tag, one destroy. The CA was created in 0.4 seconds and its first purely post-quantum chain verified.
Bound to a root in hardware the software cannot reach
EJBCA Community cannot bind a key in any HSM. The ceremony needs it to: the root signed in Fortanix DSM, then in AWS KMS, and the chain verified under both with no classical algorithm anywhere in it.
A fleet at the edge, behind AWS load balancers
Three nodes serving hybrid-KEM, ML-DSA TLS under the hardware root; a hundred certificates issued; passthrough at the NLB, classical termination at the ALB and ACM, measured and stated plainly.
Custody priced, rung by rung
From a KMS key at a dollar a month to a dedicated module at several thousand, with AWS Private CA beside the ladder — and the demonstration that the chain below the root cannot tell which rung it is on.
The silent breakages
The cryptography is not the hard part. The hard part is the dozen things around it that fail without an error, each discovered in production by a team that has already spent its budget.
- The database version that cannot name a key-encapsulation group, on any OpenSSL.
- The distribution's crypto policy that withholds the algorithms from every client and server on the host.
- The Java runtime that lists ML-DSA and will not use it; a newer Java that changes nothing.
- The channel binding that cannot hash a post-quantum certificate and fails closed.
- The "latest AMI" that would have replaced the host holding three certificate authorities.
- The authority key identifier computed from the wrong key; the verifier that does not check a root's own signature unless asked.
- The checksum that failed open; the HSM client one version too old to know the algorithm.
- The cloud certificate service that will not issue the algorithm; the load balancer that will carry it only if it does not look.
Every one of these is numbered, dated and reproducible in the findings, and each has its fix in the apparatus. That is the leverage a practitioner gets from someone who has already been there.
Latest findings
What the AWS edge will and will not carry: NLB passthrough, ALB hybrid policies, and ACM's refusal
A Network Load Balancer carried fully post-quantum TLS to a fleet without looking at it; the Application Load Balancer turned out to offer hybrid key exchange already; and AWS Certificate Manager would not accept an ML-DSA certificate at all.
Binding a free certificate authority to a root in hardware it cannot reach
Seventy minutes, scripted in advance and corrected twice, that placed the root of a post-quantum PKI in an HSM the CA software has no way to talk to. The chain verified anyway.
The library was never the variable: four layers between OpenSSL 3.5 and a post-quantum database session
PostgreSQL could not name the hybrid group, the distribution withheld the signature algorithms, the authentication protocol failed closed, and the CA's runtime chose nothing.
Working with GreenPhysics
The engagement is the product that exists today: a post-quantum PKI stood up in your own cloud account, its root bound to the custody you choose, issuing to your first fleet, with the transcripts of your build and the discipline to keep it running. Every step has been measured, so scoping is a measurement too.
How an engagement works