Research award establishes sole-source provider of post-quantum cryptography for agencies

The Small Business Innovation Research program awarded QuSecure a Phase III contract, establishing the company as the sole-source provider of post-quantum cryptography for more than a dozen federal agencies Wednesday.

QuSecure is the first quantum security-as-a-service company to achieve Phase III, intended to commercialize its software solution, QuProtect, which uses quantum-resistant cryptography to protect communications and data on any device. There is no cap on Phase III funding, with the average winner receiving more than $100 million in 2021.

SBIR made the award to hasten agencies’ adoption of post-quantum cryptography, after National Security Memorandum-10 gave them a year from the day algorithms are approved to release transition plans. Agencies are concerned that China and other nation-states are developing quantum computers capable of breaking the public-key cryptography that secures most federal systems.

“We want to work with as many [agencies] as we possibly can,” Pete “Shadow” Ford, senior vice president of federal operations, told FedScoop.  “They’re calling.”

The SBIR agencies are the Small Business Administration; departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Transportation; Environmental Protection Agency; NASA, and the National Science Foundation.

QuSecure is in talks with various Commerce agencies, DHS and the Department of Justice; is working through clearances with DOD and the Office of the Director of National Intelligence; and has agreements with several National Laboratories, Ford said.

The company’s goal is to meet agencies’ “basic” post-quantum cyber needs to start — providing each with solutions at the appropriate technology readiness level (TRL) — as it continues to work its way up the NASA-developed scale on its way toward protecting top-secret data enclaves, Ford said.

What solutions agencies need this fiscal year depends on their individual use cases and implementation timeframes.

“The Department of Justice may need something completely different, as part of their risk management framework for vulnerability, than, let’s say, a DOD customer,” Ford said. “And NASA may need something completely different for exoatmospheric than other customers that are indoatmospheric.”

QuSecure received SBIR Phase I funding, which goes up to $250,000, in 2019 and Phase II funding, up to $1.25 million, earlier this year — a testament to the speed of its Phase III award. The company only stood up federal operations in January.

Phase III also allows QuSecure to receive subcontracts and funding outside SBIR, and it can win future Phase III awards when practical.

The company is emphasizing crypto-agility, the ability to work with multiple post-quantum cryptography algorithms, as the National Institutes of Standards and Technology prepares to approve several for standardization in the next few weeks.

“Are you able to work with all?” Ford said.