Cryptography for the quantum era.
B5 Secure signs every request with keyed HMAC over the SHA-2/SHA-3 family, holds the keys in a FIPS 140-3 Level 3 HSM, and is built crypto-agile — so the move to NIST’s post-quantum standards is a configuration change, not a rewrite.
2026 extension — the HMAC scheme adds an RFC 9421 HTTP Message Signatures profile and an ML-DSA (FIPS 204) post-quantum signature option, with keys held by reference in the HSM. See Security Extensions →
Strong, standard, and replaceable.
B5’s HMAC and Service-HMAC schemes bind each request to a single operation and record with a keyed hash over the canonical message — identity, timestamp, route and body — using the SHA-2/SHA-3 family. A short expiry window and a nonce defeat replay; the integrity check defeats tampering.
Crucially, the algorithm is never hard-wired. B5 resolves its hash, signature and key-exchange primitives through a provider it can swap — the property the industry calls crypto-agility, and the single most important defense against the day an algorithm is deprecated.
// Crypto-agile by design — primitives resolved, not hard-coded
services.AddB5SecurityKit(o => {
o.Signing.Algorithm = HmacAlg.HmacSha384;
o.Keys.Source = KeySource.AzureManagedHsm; // Azure: FIPS 140-3 L3 Managed HSM
// On-prem / air-gapped: KeySource.CustomerHsm — your FIPS 140-3 module, same interface
// PQC in transit is a host setting — configure the hybrid X25519MLKEM768
// group at Kestrel (SymCrypt / OpenSSL 3.5+), not in B5.
});Illustrative configuration. Names follow the B5 Secure options surface.
Keys live where the vault standard demands.
A signature is only as trustworthy as the key behind it. B5 never holds raw key material in process — it signs by reference against hardware you control.
FIPS 140-3 Level 3
Signing keys live in Azure Key Vault Managed HSM — a single-tenant module validated to FIPS 140-3 Level 3, with key attestation proving provenance inside the hardware boundary.
Read the whitepaper →Multi-person control
The HSM security domain is split across a quorum of key holders by Shamir’s secret sharing — no single individual can export or recover key material. Rotation is policy-driven, not manual.
Read the whitepaper →Confidential by default
Encryption at rest with customer-managed keys, TLS 1.3 in transit, and confidential computing — AMD SEV-SNP, Intel TDX — to protect the most sensitive operations even in use.
Read the whitepaper →Harvest now, decrypt later — already happening.
An adversary does not need a quantum computer today to threaten you today. They can record encrypted traffic now and decrypt it once a cryptographically relevant quantum computer exists. For data with a long shelf life — financial records, identities, contracts — the clock has already started.
That is why NIST finalized the first post-quantum standards in 2024, and why Microsoft has shipped them into SymCrypt, Windows and .NET 10. B5 Secure is built to adopt them on the same timeline as the platform beneath it.
| Purpose | Standard | Algorithm |
|---|---|---|
| Key exchange protects the session | FIPS 203 | ML-KEM (Kyber) |
| Signatures code, certs, auth | FIPS 204 | ML-DSA (Dilithium) |
| Hash signatures conservative fallback | FIPS 205 | SLH-DSA (SPHINCS+) |
Post-quantum is shipping, not theoretical.
.NET 10 & SymCrypt
ML-KEM and ML-DSA are exposed to application code through .NET 10 and the Cryptography API: Next Generation, backed by SymCrypt — the same engine behind Windows and Azure. B5 consumes them through its provider.
Hybrid TLS
At the edge, the TLS 1.3 handshake combines a classical curve (X25519) with ML-KEM in one exchange — defense in depth during the transition, configured like any other TLS group on Windows Server 2025.
Quantum-safe PKI
Active Directory Certificate Services issues ML-DSA certificates (ML-DSA-44/65/87) as of 2026, bringing post-quantum signing into enterprise PKI — the trust anchors B5 validates against.
A sequenced path, aligned to Microsoft Quantum Safe.
You do not rip anything out today. You inventory, you get agile, then you migrate in the order that retires risk fastest — on a timeline that tracks Microsoft’s 2033 internal target.
Inventory your cryptography
Discover where keys, signatures and key-exchange live across the estate. B5’s centralized provider makes the application layer a single, known inventory point rather than a scattered one.
Stand on crypto-agility
Route every primitive through the B5 provider so algorithms are configuration, not code. This is the prerequisite that turns every later step into a setting change.
Enable hybrid key exchange
Turn on hybrid X25519 + ML-KEM at the edge to neutralize harvest-now-decrypt-later for data in transit, with zero change to application logic.
Adopt PQC signatures
Move service and certificate signing to ML-DSA as Azure Key Vault and your PKI light it up, keeping SLH-DSA available as a conservative hash-based fallback.
Complete the migration
Retire classical-only primitives as standards and HSM support mature, finishing in step with the Microsoft Quantum Safe Program rather than ahead of the ecosystem you depend on.
Be ready before the ciphertext you send today is read.
B5 Secure gives you crypto-agility now and a sequenced post-quantum path that moves with the Microsoft platform — not against it.