Government Tooling via Qstamp, a post quantum secure toolbox built to stop quantum computers forging AI and government records

Delaware, United States – October 13, 2026 – Quantova Inc has set out how the Qstamp family protects public finances, tax, procurement and elections that increasingly depend on AI agents. The tools make sure that no one, including an adversary holding a future quantum computer, can secretly change the record of what was decided or who allowed it. Quantova describes the family as the first post quantum secure toolbox of its kind. It runs on the Quantova Virtual Machine (QVM), signs with the NIST standard ML-DSA and gives every record a SHA3 fingerprint that can be checked in public.

• Threat. Shor’s algorithm breaks the RSA and elliptic curve signatures that protect most records of AI decisions, payments, tax, procurement and elections.
• Scale. Published estimates put a 256 bit elliptic curve key at about 2,330 logical qubits and a 2,048 bit RSA key at fewer than one million noisy qubits.
• Answer. One family of SDKs across AI, enterprise and government, built on lattice and hash based cryptography only, with no RSA, no elliptic curve and no pairing anywhere in the Quantova protocol.
• Deadline. Quantova’s timeline for moving these records to post quantum protection is 2027 to 2028.

Quantova Inc has set out how the Qstamp family protects public finances, tax, procurement and elections that increasingly depend on AI agents. The tools make sure that no one, including an adversary holding a future quantum computer, can secretly change the record of what was decided or who allowed it. Quantova describes the family as the first post quantum secure toolbox of its kind. It runs on the Quantova Virtual Machine (QVM), signs with the NIST standard ML-DSA and gives every record a SHA3 fingerprint that can be checked in public.

When the record itself becomes the target

AI agents are being given authority to place orders, move money, handle cases and draft assessments, and governments run tax, spending, procurement and elections on digital records. That evidence is protected by RSA or elliptic curve keys. A sufficiently large quantum computer could forge those signatures, a forged approval would verify exactly like a genuine one, and an adversary can copy signed records now and forge them later.

The factoring threat, step by step

1. The assumption. RSA assumes that a 2,048 bit modulus N = p × q cannot be factored. The general number field sieve, the strongest classical attack, needs about 2112 operations at this key size.
2. The quantum shortcut. Shor’s algorithm finds the order r of a random a modulo N, the smallest r with a^r ≡ 1 mod N,with a number of gates polynomial in log N, and the factors follow from gcd(ar/2 ± 1, N).
3. The curves. For a 256 bit prime curve the published circuit needs 9n + 2⌈log2 n⌉ + 10 = 2,330 logical qubits and about 1011 Toffoli gates.
4. The trend. Estimates for 2,048 bit RSA fell from 20 million noisy qubits (Gidney and Ekerå, 2019) to fewer than one million (Gidney, 2025).

The post quantum secure toolbox

Every tool uses two primitives that contain no factoring problem. Each record is signed with ML-DSA and reduced to a salted SHA3-256 fingerprint on the organisation’s own servers, and only one 32 byte commitment per batch reaches the network. Anyone can see on QVMScan that an anchor exists, but no one can read the record behind it. Every SDK is released on npm and GitHub and anchors live on the Quantova network.

• Qstamp. The anchoring core. It batches salted fingerprints into an RFC 9162 tree and anchors the root, proving that a decision, model, dataset or document existed in exactly that form no later than its block.
• QSign. Signs documents and decisions with ML-DSA under its own context string, and with a Qstamp anchor proves who signed what and when.
• QMandate. Binds an agent to a signed mandate naming its actions, limits, counterparties and period, and checks each action offline before it runs, so an action outside the mandate is never executed.
• QLog. Chains every entry to the one before it and seals the chain with anchored checkpoints, proving that no entry was removed or reordered and that the agent declared its intent before it acted.
• QTrace. Signs provenance claims for content and models and binds them to C2PA manifests, proving which registered model and authorised producer stand behind a document, image or answer.

QGOV, For goverments

• QTax. Seals filings, invoices, claims, assessments and refunds under separate intake, assessor and officer keys. Each refund carries its position and running total, so no refund can exceed what was assessed or be hidden.
• QSpend. Seals each stage from appropriation to commitment, receipt, invoice and payment, and links each payment to the budget line that authorised it.
• QProcure. Fixes the tender criteria before publication and a salted commitment to each bid before the deadline, then seals each evaluator’s scores, the award and every amendment.
• QDeclare. Seals each asset and interest declaration of an official at filing and links it to the previous one, so the full history can be verified year by year.
• QAid. Links every grant, subsidy and aid payment to a sealed eligibility decision and the programme rules in force, with beneficiaries named only by salted commitments.
• QBallot. Seals software registration, officials’ mandates, station returns, salted ballot records and every tabulation action, so a declared result can be proven equal to the certified returns without revealing any vote.

QUANTA smart contracts

Anchors are written by a Quanta smart contract on the Quantova Virtual Machine, and a Quanta registry contract records the public keys of every official and system role together with their revocation, so a key reported lost or compromised stops verifying across every system that relies on it.

Quantova infrastructure and the QVM

The tools sit on infrastructure with nothing classical to break. Accounts sign with ML-DSA-65 or the hash based SLH-DSA of FIPS 205, validators sign finality certificates with ML-DSA-65, and nodes connect through an ML-KEM and ML-DSA handshake. Tests named no classical fail the node build if any of 19 named classical libraries enters its dependency tree.

1. The lattice. ML-DSA-65 works over the ring Zq[X]/(X256+1) with q = 8,380,417 and a 6 by 5 public matrix at NIST security category 3. A public key is 1,952 bytes and a signature 3,309 bytes.
2. The fingerprint. SHA3-256 is a Keccak sponge with a 1,088 bit rate and a 512 bit capacity. Grover’s algorithm still needs about 2128 steps to invert it, and a fresh 256 bit salt per record stops a guess being confirmed.
3. The commitment. One batch holds up to 220 records in an RFC 9162 tree, and the proof for one record is at most 20 hashes, or 640 bytes.
4. The machine. The QVM has 16 registers of 64 bit words, no floating point and checked arithmetic, with instructions for SHA3-256, ML-DSA-65, SLH-DSA, ML-KEM and Merkle proofs and none for elliptic curves. Verifying an ML-DSA-65 signature costs a fixed 60,000 units.
5. The finality. A block is final once more than two thirds of the committee have signed with ML-DSA-65, in about 0.2 seconds, and a final block never reverts.

Who integrates it

Ministries of finance, tax authorities, procurement agencies, ethics bodies and election authorities call the QGov tools from the systems they already run. Central banks and payment infrastructure accept an agent’s instruction only with a valid mandate. Regulators, auditors and courts verify rather than integrate, checking any record and its receipt without access to the holder’s systems or trust in Quantova Inc.

The 2027 to 2028 deadline

Quantova’s timeline sets 2027 to 2028 as the deadline for government and financial institutions to move these records to post quantum protection, because records created after that point will still be held when large quantum computers could arrive. Executive Order 14412 requires federal high value systems to adopt post quantum digital signatures by 31 December 2031. Draft NIST IR 8547 proposes retiring quantum vulnerable algorithms altogether.

About Quantova Inc

Quantova Inc is a Delaware corporation that designs, builds and owns the Quantova technology, a network built post quantum from its genesis block, together with its cryptography library, the Quanta smart contract language, the Quantova Virtual Machine and the Qstamp family of SDKs. The whole family is open source under the Apache 2.0 and MIT licences, and Quantova Inc owns the Qstamp, Quantova, QVM and Quanta trademarks.

Learn more about:

Qstamp at qstamp.org.

Quantova at quantova.org.

SDKs at npmjs.com/org/quantovainc.

Explorer at qvmscan.io.

Source code at github.com/Quantova.

Media enquiries by email to support@qstamp.org.

Media Contact
Company Name: Quantova Inc
Contact Person: Sheila Lugosi
Email: Send Email
State: Delaware
Country: United States
Website: qstamp.org