Q-VIKRAM is an FPGA-based 1 Gbps post-quantum network encryptor designed to protect Layer 2 Ethernet and Layer 3 IP traffic. It combines post-quantum crypto algorithms NIST FIPS-203 ML-KEM-1024 with AES-256-GCM and a hybrid session-key derivation mechanism based on NIST SP 800-56C Rev. 2.
Q-VIKRAM supports pre-shared keys (PSKs) and optional Quantum Key Distribution (QKD) inputs, with an enhanced IPsec architecture supporting up to 1,024 Security Associations for point-to-point, point-to-multipoint and mesh deployments.
Cryptographic Architecture
β’ Post-Quantum Key Encapsulation: Hardware-accelerated NIST FIPS 203 ML-KEM-1024 (NIST Security Level 5).
β’ Bulk Data Protection: Wire-speed AES-256-GCM encryption.
β’ Hybrid Key Derivation: NIST SP 800-56C Rev. 2 compliant session-key derivation mechanism.
β’ Flexible Key Ingestion: Native ingestion for Pre-Shared Keys (PSKs) and external Quantum Key Distribution (QKD) key feeds.
β’ Entropy Generation: Hardware True Random Number Generator (TRNG) designed as per NIST SP 800-90B recommendations.
β’ All-Hardware Implementation: Cryptographic primitives, key-derivation pipelines, and TRNG logic fully implemented in FPGA HDL.
β’ Red/Black Domain Separation: Strict logical hardware isolation between plaintext (Red) and ciphertext (Black) processing zones.
β’ Crypto Agility & Field Upgrades: Field replaceable Symmetric Crypto IP cores with built-in architecture support for sovereign and proprietary symmetric cryptographic algorithms.
Crypto IP Core
β’ SCA resistant FIPS-203 ML-KEM-1024 FPGA IP Core
β’ SCA resistant AES-256-GCM FPGA IP Core
Interfaces
β’ Plain Text Ports: Two 10/100/1000 Base-T (RJ45) interfaces and Two 1G/10G Single Mode Duplex LC Connector
β’ Cipher Text Ports: Two 10/100/1000 Base-T (RJ45) interfaces and Two 1G/10G Single Mode Duplex LC Connector
β’ One UART port for Child Fill Gun (CFG)
β’ One USB 2.0 port for Algorithm Loading Device (ALD)
β’ One USB-UART Console Interface
β’ QKD interface (1 G Ethernet MACsec β RJ45 & Optical-OM3)
β’ NMS interface (1 G Ethernet MACsec β RJ45 & Optical-OM3)
β’ GUI Interface (1 G Copper RJ45)
β’ 1 X Auxiliary UART and 1 X Auxiliary RJ45
Dimensions
β’ 2U (EIA) 3.5β H X 19β W X 23β D
Power Supply
β’ DC Ports : 18-75 V DC (Two)
β’ AC Ports : 90β264 V AC, 50/60 Hz (Two)
All power supplies are in hot standby mode
(220V AC to 24V DC adaptor shall be provided for DC ports)
Cooling/Thermal
β’ Convection cooled (Side-Fans)
Battery
β’ Two external battery ports for RTC and Tamper
β’ Li-SOCl2 Type D 3.6 V Primary Cell (Two)
Power Consumption
β’ Power consumption 200 Watts (Typical)
LED Indications
β’ Encryption Mode (L2/L3)
β’ Power Supply Status
β’ System Health Status
β’ Emergency Erasure
β’ Tamper Detection
β’ IPsec Tunnel Status
β’ Pre Shared Keys Load Status
β’ Links Status
User Interface
β’ Console
β’ Web GUI
Emergency Erasure
β’ Keylock switch based emergency erasure (Two keys)
Multi-factor Operator Authentication (MFA)
β’ Crypto Ignition Key (CIK) token
β’ Keypad for PIN
β’ Alphanumeric password
β’ Critical Government & Defense Networks: Quantum-safe secure communications across tactical and strategic backbones.
β’ Layer 2 Data Center Interconnects (DCI): Transparent, ultra-low-latency MACsec frame encryption over optical metro links.
β’ Enterprise IPsec VPN Infrastructure: Post-quantum cryptographic tunneling across distributed enterprise branches, financial institutions, and data centers.
β’ QKD Infrastructure Integration: Immediate quantum-resilient cryptographic deployment paired directly with optical QKD links
Cryptographic Architecture
β’ Post-Quantum Key Encapsulation: Hardware-accelerated NIST FIPS 203 ML-KEM-1024 (NIST Security Level 5).
β’ Bulk Data Protection: Wire-speed AES-256-GCM encryption.
β’ Hybrid Key Derivation: NIST SP 800-56C Rev. 2 compliant session-key derivation mechanism.
β’ Flexible Key Ingestion: Native ingestion for Pre-Shared Keys (PSKs) and external Quantum Key Distribution (QKD) key feeds.
β’ Entropy Generation: Hardware True Random Number Generator (TRNG) designed as per NIST SP 800-90B recommendations.
β’ All-Hardware Implementation: Cryptographic primitives, key-derivation pipelines, and TRNG logic fully implemented in FPGA HDL.
β’ Red/Black Domain Separation: Strict logical hardware isolation between plaintext (Red) and ciphertext (Black) processing zones.
β’ Crypto Agility & Field Upgrades: Field replaceable Symmetric Crypto IP cores with built-in architecture support for sovereign and proprietary symmetric cryptographic algorithms.
Crypto IP Core
β’ SCA resistant FIPS-203 ML-KEM-1024 FPGA IP Core
β’ SCA resistant AES-256-GCM FPGA IP Core
Interfaces
β’ Plain Text Ports: Two 10/100/1000 Base-T (RJ45) interfaces and Two 1G/10G Single Mode Duplex LC Connector
β’ Cipher Text Ports: Two 10/100/1000 Base-T (RJ45) interfaces and Two 1G/10G Single Mode Duplex LC Connector
β’ One UART port for Child Fill Gun (CFG)
β’ One USB 2.0 port for Algorithm Loading Device (ALD)
β’ One USB-UART Console Interface
β’ QKD interface (1 G Ethernet MACsec β RJ45 & Optical-OM3)
β’ NMS interface (1 G Ethernet MACsec β RJ45 & Optical-OM3)
β’ GUI Interface (1 G Copper RJ45)
β’ 1 X Auxiliary UART and 1 X Auxiliary RJ45
Dimensions
β’ 2U (EIA) 3.5β H X 19β W X 23β D
Power Supply
β’ DC Ports : 18-75 V DC (Two)
β’ AC Ports : 90β264 V AC, 50/60 Hz (Two)
All power supplies are in hot standby mode
(220V AC to 24V DC adaptor shall be provided for DC ports)
Cooling/Thermal
β’ Convection cooled (Side-Fans)
Battery
β’ Two external battery ports for RTC and Tamper
β’ Li-SOCl2 Type D 3.6 V Primary Cell (Two)
Power Consumption
β’ Power consumption 200 Watts (Typical)
LED Indications
β’ Encryption Mode (L2/L3)
β’ Power Supply Status
β’ System Health Status
β’ Emergency Erasure
β’ Tamper Detection
β’ IPsec Tunnel Status
β’ Pre Shared Keys Load Status
β’ Links Status
User Interface
β’ Console
β’ Web GUI
Emergency Erasure
β’ Keylock switch based emergency erasure (Two keys)
Multi-factor Operator Authentication (MFA)
β’ Crypto Ignition Key (CIK) token
β’ Keypad for PIN
β’ Alphanumeric password
β’ Critical Government & Defense Networks: Quantum-safe secure communications across tactical and strategic backbones.
β’ Layer 2 Data Center Interconnects (DCI): Transparent, ultra-low-latency MACsec frame encryption over optical metro links.
β’ Enterprise IPsec VPN Infrastructure: Post-quantum cryptographic tunneling across distributed enterprise branches, financial institutions, and data centers.
β’ QKD Infrastructure Integration: Immediate quantum-resilient cryptographic deployment paired directly with optical QKD links
