Abstract: Systems and methods for high-performance quantum-safe key management are disclosed. A method may include: (1) receiving, by a client service router, a client request for an operation involving a key from a client computer program; (2) authenticating, by the client service router and using a credentials operations service, the client request; (3) verifying, by the client service router and using a credentials operating service, permission for the client request; (4) routing, by the client service router, the request to a cryptoprocessor, wherein the cryptoprocessor is configured to execute the operation; (5) receiving, by the client service router, a result of the execution of the operation from the cryptoprocessor; and (6) returning, by the client service router, the result to the client computer program.

Abstract: A method may include: receiving, by a webserver computer program, shared key material shared with a client application; receiving from a browser, a request for a secure connection; establishing a session with the browser over a first secure connection; establishing a shared secret key with the browser, wherein the browser creates a browser secret key encrypted with the shared secret key, encrypts the browser secret key with the shared secret key, and provides the browser secret key encrypted with the shared secret key and session information the client application over a second secure connection that is protected with the shared key material; decrypting the browser secret key encrypted with the shared secret key using the shared secret key; identifying the session with the browser from the session information; and establishing, end-to-end encryption on top of the second secure connection using the browser secret key or a derivation thereof.

Abstract: A method may include: (1) receiving, at a quantum key distribution node in a network of a plurality of quantum key distribution nodes, a quantum key; (2) distributing, by the quantum key distribution node, the quantum key to the other quantum key distribution nodes over a subset of the direct connections; (3) communicating, by one of the plurality of quantum key distribution nodes, the quantum key to a central key management service node, wherein the central key management service node is hardwired to the quantum key distribution node; (4) communicating, by the central key management service node, the quantum key to a secondary key management service node; (5) communicating, by the secondary key management service node, the quantum key to a last mile device; and (6) using, by the last mile device, the quantum key to encrypt or decrypt data.

Abstract: A method may include a first verifier computer program receiving an interaction with a first prover computer program for a client that requires verification comprising an identifier for the client; generating a challenge using a public identification key; issuing the challenge to the first prover computer program and to a second prover computer program; receiving a first response from the first prover computer program and a second response from the second prover computer program; determining that the first response and the second response were received within a predetermined amount of time; determining the first response and the second response are consistent; and informing the first prover computer program that the verification was successful.

Abstract: A method may include a first verifier computer program receiving an interaction with a first prover computer program for a client that requires verification comprising an identifier for the client; generating a challenge using a public identification key; issuing the challenge to the first prover computer program and to a second prover computer program; receiving a first response from the first prover computer program and a second response from the second prover computer program; determining that the first response and the second response were received within a predetermined amount of time; determining the first response and the second response are consistent; and informing the first prover computer program that the verification was successful.

Abstract: A method may include: receiving, by a webserver computer program, shared key material shared with a client application; receiving from a browser, a request for a secure connection; establishing a session with the browser over a first secure connection; establishing a shared secret key with the browser, wherein the browser creates a browser secret key encrypted with the shared secret key, encrypts the browser secret key with the shared secret key, and provides the browser secret key encrypted with the shared secret key and session information the client application over a second secure connection that is protected with the shared key material; decrypting the browser secret key encrypted with the shared secret key using the shared secret key; identifying the session with the browser from the session information; and establishing, end-to-end encryption on top of the second secure connection using the browser secret key or a derivation thereof.