Is Bidda quantum-resistant?

Partly, and we publish exactly which parts. Content integrity and our tamper-evident record log are hash-based (SHA-256, RFC 6962 Merkle tree) and are not broken by quantum computers. Transport uses hybrid post-quantum key agreement today. Record signatures are Ed25519, which a quantum computer would eventually break, and that layer is on a stated migration path. We do not describe Bidda as a quantum-safe platform, because that would not be accurate.

Does Bidda use post-quantum encryption for its API?

Yes for key agreement. Connections to the Bidda public API negotiate X25519MLKEM768, a hybrid that combines classical X25519 with ML-KEM-768 (FIPS 203). Hybrid means both components would have to be broken for the session key to fall, so the connection is never weaker than the classical one alone. Verify it with: openssl s_client -connect bidda.com:443 -groups X25519MLKEM768 (requires OpenSSL 3.5 or later).

Will a record signed by Bidda today still verify after quantum computers arrive?

The integrity portion will, because it is hash-based. The signature portion uses Ed25519, which is why we treat it as the layer to migrate first. Our stated direction is a hybrid signature, where a record carries its existing signature plus an additional one under a post-quantum standard. The architecture already supports this without invalidating anything: the additional signature is carried outside the signed content, so records issued before the change continue to verify unchanged.

Do quantum computers break SHA-256?

No, not in any practical sense. Grover's algorithm gives a quadratic speed-up against a preimage search, which reduces SHA-256 from a 256-bit to roughly a 128-bit security margin. A 128-bit margin remains beyond practical reach, and the speed-up does not parallelise well, so the real-world margin is larger still. This is why NIST's own post-quantum signature standard SLH-DSA (FIPS 205) is built entirely out of hash functions.

Does using Bidda make my organisation compliant with post-quantum migration rules?

No. Bidda describes post-quantum migration obligations and traces each to its primary source, including the EU coordinated roadmap, UK NCSC timelines, Canadian federal milestones and the US federal instruments. It does not certify that your organisation has met them, and nothing Bidda publishes is legal advice.

When is the post-quantum migration deadline?

There is no single deadline, which is the practical problem. Jurisdictions have published different target years for different classes of system, and they do not agree. Bidda tracks the published obligations per jurisdiction with citations to each primary source, so a team can compare what applies to them rather than working from one headline date.

Bidda Sovereign Intelligence · 10,090 Verified Nodes · 39 Sovereign Pillars

Cryptographic Posture and Post-Quantum Readiness — Bidda

Which cryptographic primitives Bidda relies on, which are affected by quantum computers, and what happens to already-issued records when they are replaced. Every claim is independently checkable.

⚠ Important: Human Verification Required

Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.