POST-QUANTUM OT SECURITY PLATFORM

CIRTI
QA

Deterministic · Zero-Trust · Post-Quantum Encrypted & Authenticated
0FALSE POSITIVES
<1μsPOLICY DECISION
256bQUANTUM SECURITY
Q·AUTHQUANTUM AUTH
100%OT PROTOCOL COVERAGE
CORE ARCHITECTURE // 01

Four Unbreakable Pillars

01

Deterministic Policy Engine

Allowlist-only communication policies compiled into immutable finite-state machines. Binary permit/deny decisions with no ML, no heuristics — mathematically provable correctness at every hop. Zero false positives. Safe for SIL-rated environments.

FSM-BASEDALLOWLIST-ONLYFORMAL VERIFIED
02

Post-Quantum Secure Comms

CRYSTALS-Kyber for quantum-secure key encapsulation on all sensor channels and CRYSTALS-Dilithium for post-quantum digital signatures — per NIST FIPS 203/204. Harvest-now/decrypt-later attacks rendered permanently obsolete. Every packet decision, every log event, every policy update is quantum-signed.

KYBER-1024DILITHIUM-5NIST FIPS 203/204
03

Full OT Visibility

Passive deep-packet inspection across Modbus, DNP3, IEC 61850, PROFINET, EtherNet/IP, BACnet and more. Protocol-accurate asset auto-discovery with no active probing — zero disruption to safety-critical operations. Every device is assigned a UUID and tracked in the live asset graph.

PASSIVE DPI12 PROTOCOLSASSET GRAPH
04

Immutable Quantum Log

Append-only, Merkle-tree-chained event log. Every packet decision is quantum-signed with Dilithium5 at ingestion. Tamper evidence is mathematically provable. No trusted third party required. Satisfies NERC CIP, IEC 62443, and NIS2 audit requirements out of the box.

MERKLE CHAINPQC-SIGNEDWORM-COMPLIANT
POST-QUANTUM SPECIFICATIONS // 02

Post-Quantum Specifications

Cirtiqa's platform is built on the three NIST post-quantum cryptographic standards — providing quantum-secure key exchange, digital signatures, and device authentication across every layer of the OT security stack. All classical asymmetric primitives have been removed; every channel, log event, and credential is quantum-hardened from day one.

For device identity, Cirtiqa extends post-quantum cryptography with a quantum authentication layer — embedding unforgeable device credentials directly into quantum random streams. Credentials are single-use, replay-immune, and statistically indistinguishable from random data to any observer without the device key.

⬡ Quantum Authentication Parameters

Proven via NIST Statistical Test Suite — signed blocks are indistinguishable from raw quantum random data.

BLOCK / DIGEST

2048-bit random block with 256-bit SHA3 digest. Brute-force attack space: 1.50 × 10⁴¹² — computationally infeasible.

REPLAY PROTECTION

Sequential counter (nonce) ensures each credential is single-use. Counter increment is synchronised between device and verifier.

OPTIONAL AUTHORISATION

Second-level key embedded within the signed block enables authorisation scoping — defining which OT operations an authenticated identity is permitted to invoke.

CRYSTALS-KYBERFIPS 203
USE CASEKey Encapsulation — all sensor channels
VARIANTML-KEM-1024 (Level 5)
SECURITY256-bit post-quantum
LATENCY<0.5ms ARM Cortex-A
HARVEST IMMUNEYes — all captured traffic undecryptable
CRYSTALS-DILITHIUMFIPS 204
USE CASESignatures — log events, policies, alerts
VARIANTML-DSA-87 / Dilithium5
SECURITY256-bit post-quantum
SIGN LATENCY<2ms ARM Cortex-A
APPLIED TOEvery log event, every policy manifest
QUANTUM AUTHENTICATIONQRNG AUTH
USE CASEDevice authentication & authorisation
BLOCK SIZE2048 bits from QRNG source
INDEX BITS256 (SHA3-256 digest size)
NIST SUITEAll 15 tests passed — indistinguishable
ANTI-REPLAYSequential counter nonce
SYSTEM DESIGN // 03

Data Flow Architecture

PACKET DECISION PIPELINE

DETERMINISTIC
INGRESS TAPPASSIVE COPY — NO INLINE
PROTOCOL DISSECTORMODBUS / DNP3 / IEC 61850 / PROFINET / EIP
ASSET RESOLVERUUID LOOKUP
Q-AUTH VERIFIERQUANTUM AUTH CHECK
POLICY FSM LOOKUPO(1) HASH — <1μs
PERMIT → LOG + FORWARD
DENY → ALERT + DROP
QUANTUM-SIGN EVENTDILITHIUM-5 SIGNATURE
MERKLE APPENDIMMUTABLE CHAIN UPDATE
KYBER-1024 TXQUANTUM-SECURE NORTHBOUND

LIVE EVENT LOG

QUANTUM-SIGNED
THREAT COVERAGE // 04

Addressed Attack Vectors

CRITICAL

Rogue Command Injection

Attacker injects unauthorized Modbus write or DNP3 control commands to manipulate PLC outputs, potentially causing physical damage or process disruption.

✓ FSM allowlist blocks all commands not in quantum-signed policy manifest. Zero-day immune.
CRITICAL

Harvest-Now / Decrypt-Later

Nation-state adversary records encrypted OT communications today, planning to decrypt with future quantum computer to extract process intelligence or authentication material.

✓ Kyber-1024 KEM renders all captured ciphertext computationally infeasible to decrypt post-quantum. Communications are quantum-secure from day one.
CRITICAL

Device Identity Spoofing

Attacker masquerades as a trusted PLC, RTU, or sensor by replaying captured authentication credentials, gaining unauthorized access to safety-critical commands.

✓ Quantum authentication — credentials are single-use quantum-derived blocks, indistinguishable from noise. Replay attacks cryptographically impossible.
CRITICAL

Log Tampering & Forgery

Insider or advanced attacker modifies audit logs post-incident to conceal malicious activity, undermine forensic investigations, or create false evidence.

✓ Merkle chain + Dilithium5 quantum signatures make any alteration immediately and mathematically detectable.
HIGH

Lateral Movement via OT

Compromised IT endpoint pivots into OT network through permissive zone boundaries, exploiting the expanded IT/OT convergence attack surface.

✓ Microsegmentation policy enforced per asset UUID. Unrecognized sources are silently dropped with no probe response.
MEDIUM

Rogue Asset Insertion

Unauthorized device physically connected to OT network and begins communicating, attempting to masquerade as a trusted sensor or engineering workstation.

✓ Every asset requires a quantum-signed identity token. Quantum authentication detects any device unable to produce valid quantum credentials.
THE CIRTIQA DIFFERENCE // 05

Why Cirtiqa

Most OT security vendors offer visibility. Some offer detection. Very few offer quantum-secure communications. Only Cirtiqa offers all four — deterministic enforcement, passive visibility, post-quantum cryptography, and quantum-based device authentication — in a single, cohesive platform designed specifically for operational technology.

01

Quantum-Secure from Day One

We implemented NIST FIPS 203/204/205 post-quantum standards before they were mandated. Every channel, every log event, every policy update has been quantum-secure since our first release. There is no "migration path to PQC" — it is our baseline.

ML-KEM-1024 · ML-DSA-87 · SPHINCS+
02

Quantum Authentication — Not Just Encryption

Our quantum authentication embeds unforgeable device identities into quantum random streams. This goes beyond encrypting communications — it makes device credentials themselves quantum-derived and quantum-verified. Replay attacks, credential theft, and spoofing become computationally impossible.

QUANTUM AUTH · QRNG NATIVE
03

Zero False Positives — Guaranteed

Our deterministic FSM policy engine produces no probabilistic decisions. Every verdict is permit or deny, computed in constant time from a formally verifiable allowlist. This is not achievable with ML-based anomaly detection, and it is the only approach safe for SIL-rated safety-instrumented systems.

FSM · FORMALLY VERIFIABLE · TLA+
04

Mathematically Tamper-Proof Audit Trail

Our Merkle-chained, Dilithium5-signed log makes any retroactive modification to audit records mathematically detectable without a trusted third party. Auditors verify log integrity offline using only the chain root hash and the root CA public key.

MERKLE · DILITHIUM5 · WORM
05

Built for Operations, Not Against Them

Passive-only deployment means we monitor without touching. We never inject packets, never scan, never probe. Our platform has been deployed in active refinery, substation, and water treatment environments with zero reported operational incidents caused by the security platform itself.

PASSIVE TAP · SPAN ONLY · ZERO DISRUPTION
06

Air-Gap Ready, Cloud-Optional

The Cirtiqa platform operates with zero outbound internet connectivity. No telemetry, no license callbacks, no cloud dependencies. Threat intelligence arrives as signed offline bundles. The entire platform — management console, log store, key management — can be deployed in a fully isolated network.

AIR-GAP CAPABLE · NO CLOUD REQUIRED
CONTACT // 06

Get in Touch

Whether you are planning a new OT security programme, upgrading legacy monitoring to quantum-secure standards, or need to address a specific compliance requirement — the Cirtiqa team is ready to help. Our specialists come from OT operations, not IT, and will engage at the level your environment demands.

Saudi Arabia · Middle East · Available Globally
NIST FIPS 203NIST FIPS 204NIST FIPS 205IEC 62443NERC CIPNIS2NIST SP 800-82FIPS 140-3