Feranor PQC Suite
Post-quantum cryptography, today
Feranor PQC Suite encrypts, decrypts, signs and verifies your data with post-quantum algorithms, hybrid with classical ones as ANSSI recommends, so that what you protect today stays protected once quantum computers can break RSA and elliptic curves.
It writes and reads standard formats only: CMS messages (RFC 5652), keys as SubjectPublicKeyInfo and PKCS#8. No primitive is reimplemented: they come from the platform, OpenSSL 3.5 on Linux, with no third-party cryptographic library.
The ANSSI profile applies by default, to what is read as much as to what is written: a message, a key or a signature outside it is refused, so a correspondent cannot impose a weaker algorithm.
Why now
Data encrypted today can be collected now and decrypted later, once quantum computers are able to. The transition has dates, and that data must stay confidential long after them.
- 2027: ANSSI aims at post-quantum cryptography for qualification
- 11 December 2027: every obligation of the Cyber Resilience Act applies
- End of 2030: high-risk uses migrated, in the coordinated roadmap of the EU Member States
- After 2030: ANSSI advises against purchases without post-quantum cryptography
- End of 2035: medium-risk uses migrated
A French solution, under your sole control
- French vendor. Feranor, a company from the Lyon area; the suite is designed, developed and supported in France, in French and in English
- Your keys stay with you. Everything runs in your infrastructure, on premises or in your cloud; no key, no data and no telemetry leaves it
- No imposed service. No account, no cloud, no connection to Feranor; the suite runs on an isolated network
- ANSSI's doctrine by default. Hybridization required, the ANSSI profile applied to everything that comes in and goes out
- Open formats. Standard CMS messages and PKCS#8 keys, readable by any conforming tool; no lock-in
Four components, one engine
The SDK, the command line and the sidecar produce and read the same messages and share the same key store; the console gives business users the same operations in a browser.
Feranor PQC SDK for .NET
NuGet packages for .NET 10 applications, in process, with dependency injection and Native AOT. The key store secret comes from a mounted file or straight from Azure Key Vault, AWS Secrets Manager, Google Cloud Secret Manager or HashiCorp Vault.
Feranor PQC CLI (fpqc)
Encrypt, decrypt, sign, verify and inspect files of any size, manage, back up and rotate keys, and bring archives encrypted with RSA or ECDH to post-quantum recipients. A native binary for Linux and Windows, a .NET tool and a container image.
Feranor PQC Sidecar
The same operations as an HTTP API on a Unix socket or on TCP with a token, for applications in Java, Python, Node, Go or any other language. A minimal container image, with a hash-chained audit journal. Its contract is public, as an OpenAPI 3.1 description that the sidecar's own tests check.
Feranor PQC Console
A web page in French and English over the sidecar, for business users who encrypt, sign and check files. It holds no key and does no cryptography of its own.
Cryptography and standards
- Key establishment: ML-KEM only as a hybrid with ECDH, MLKEM1024-ECDH-P384 by default
- Content: AES-256-GCM in memory, AES-256-CBC then HMAC-SHA-512 for streams of any size
- Signature: SLH-DSA, hybrid by default with an ECDSA P-384 co-signature
- Integrity first: a modified message is refused before any byte in clear is written
- Nothing to learn from a refusal: a modified message gets the same error whichever byte was changed, which our tests check byte by byte, and every line of our code that handles a secret is reviewed for timing leaks
- Standards: CMS (RFC 5652, 5083, 9629), ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), composite ML-KEM (IETF LAMPS drafts), checked against the official NIST vectors and the RFC examples
A Standard profile also accepts ML-KEM and ML-DSA alone, for partners outside the ANSSI framework.
Compliance and trust
- Declared to ANSSI: a means of cryptology declared on 15 October 2026 (declaration no. 34734727), for its supply, transfer, import and export
- ANSSI profile: the default profile follows the Guide des mécanismes cryptographiques (ANSSI-PG-083, version 3.00) and its post-quantum recommendations, hybridization included
- Cyber Resilience Act: vulnerability handling, a CycloneDX software bill of materials for every component, security fixes free of charge for every user of a supported version
- A verifiable delivery: the checksums of every release are signed with Feranor's release certificate (SLH-DSA-SHA2-256s)
- Nothing calls Feranor: the license key is checked offline, with no telemetry; it conditions no cryptographic function
Trust and transparency
- Architecture. How the suite fits in your infrastructure, where its keys are and what crosses your network
- Releases. The published versions and the certificate that checks every archive
- Security advisories. What we publish when a vulnerability is fixed, how to report one, and our advisories in CSAF
- Security pack. For your supplier assessment, our security assurance plan with the product's security, architecture, standards and profiles, in English or French, sent on request to sales@feranor.com
Performance
Measured with BenchmarkDotNet, ANSSI profile and one recipient unless stated otherwise, on two machines: a recent workstation (Intel Core Ultra 9 185H, 22 logical cores, Linux under WSL 2) and a shared cloud virtual machine with 2 vCPUs.
| Measure | Recent workstation | 2-vCPU VM |
|---|---|---|
| A small message (1 KB), encrypt then decrypt | 0.7 ms, then 0.4 ms | 2 ms, then 0.7 ms |
| Default hybrid key exchange (MLKEM1024-ECDH-P384), encapsulate then decapsulate | 0.7 ms, then 0.4 ms | 3.3 ms, then 3.4 ms |
| Files of any size, streamed, constant memory | 600 to 770 MB/s (memory to memory) | 250 to 300 MB/s (file to file) |
| SLH-DSA-SHA2-256f signature (ANSSI profile) | 43 ms; co-signed with ECDSA P-384 through the key store, 45 ms, and 11 ms per signature on 4 threads | 163 ms |
| Verify an SLH-DSA signature | 1.4 ms | 5 ms |
| ML-DSA-65 signature (Standard profile), sign then verify | 0.7 ms, then 0.2 ms | 1.4 ms, then 0.4 ms |
| fpqc, a 100 MB file | not measured | 0.4 s to encrypt, 1.2 s to decrypt (integrity checked first) |
| fpqc, start-up | not measured | 9 ms, an 8 MB native binary |
| Sidecar, one instance | not measured | About 300 encryptions and 540 decryptions per second, each one journaled |
Linux, .NET 10 and OpenSSL 3.5: orders of magnitude, to be measured on the target hardware for sizing. SLH-DSA is slow to sign by design, the price of its robustness; composite ML-DSA, much faster, will follow once .NET supports it in CMS.
Platforms
- Linux x64 with OpenSSL 3.5 or later: every algorithm and every component
- Containers (Docker, Kubernetes): minimal images without shell, non-root, the sidecar next to the application
- Windows 11 and Windows Server: the SDK and the command line for encryption; no SLH-DSA, so no signature under the ANSSI profile
- Support: 5 years of maintenance per major version, by e-mail in French or English; messages and keys stay readable across versions
Pricing
One price, everything included, as an annual subscription per legal entity, whatever the number of applications, servers or developers.
- Company or private organization: €20,000 excl. VAT a year
- Public sector, local authority, public body, hospital, administration: €18,000 excl. VAT a year
- Group: the price above for each legal entity that uses the product
- Integration into a product resold to third parties, software vendors and IT services firms: on quotation
- Perpetual license, one payment instead of the subscription, a license key that never expires, optional annual maintenance: on quotation
The four components, every version released during the subscription, and support.
Protect today what must stay secret tomorrow
Tell us about your applications, your data and your constraints, and we show you the suite on your own use case.