Network time with post-quantum key exchange.

Notes. Host beatquantum.com, stratum 2, located in the UK, reachable over IPv4 and IPv6. Add it alongside your existing NTS sources. BeatQuantum runs the world's first public NTS service with post-quantum key exchange. In our surveys of public NTS servers in July and August 2026, every other server negotiated classical key exchange only; method and full results are in the data room.

• Pure post-quantum: ML-KEM-512, ML-KEM-768 and ML-KEM-1024 (FIPS 203), plus further pure PQC algorithms at every security level.
• Hybrid: the IETF standards-track X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024, plus further hybrid PQC algorithms combining each post-quantum KEM with X25519, X448, the NIST P-curves or Brainpool.
• Classical: X25519, X448, the NIST P-curves and Brainpool, so older clients keep working.
• Not offered: SM2 and the finite-field Diffie-Hellman (FFDHE) groups, by design.

Method. Measured on 2 November 2026 from an independent host on the public Internet, one TLS 1.3 handshake per group with ALPN ntske/1, offering a single group at a time. Today's mainstream clients offer X25519MLKEM768 or a classical group and get exactly that. The other pure and hybrid PQC algorithms use experimental code points, reachable by clients whose cryptographic libraries support them. The server certificate is ECDSA P-384.

• Post-quantum certificates: publicly trusted ML-DSA certificates from public certificate authorities, to replace the ECDSA P-384 server certificate.
• Upstream time: post-quantum NTS from upstream time sources, including the national time laboratories.
• Client TLS libraries: ML-KEM in the TLS libraries that distribution clients use, for example GnuTLS, which chrony uses on Debian. Until then those clients negotiate a classical group.

# Hybrid X25519MLKEM768 (OpenSSL 3.5 or later)
openssl s_client -connect beatquantum.com:4460 -alpn ntske/1 -groups X25519MLKEM768 -brief </dev/null

# Pure ML-KEM-1024 only, no classical fallback
openssl s_client -connect beatquantum.com:4460 -alpn ntske/1 -groups MLKEM1024 -brief </dev/null

# chrony: NTS mode, key length and cookies per source
chronyc -N authdata

• Monitoring: daily automated update checks for our cryptographic libraries; operating-system security advisories for the time server and its libraries; publications of NIST, the IETF, BSI, ANSSI, NCSC and other national authorities; and published cryptanalysis of every pure and hybrid PQC algorithm we run.
• Advisory: a notice on our status page within 24 hours of credible verification that an algorithm or parameter set in use is compromised or deprecated, stating what is affected, what we have changed and whether clients need to act.
• Compromise: a key-exchange algorithm is removed within 1 hour of credible verification. A replacement server certificate is deployed within 1 hour of becoming available. A cipher suite or symmetric algorithm is removed within 1 hour where a configured alternative exists.
• Deprecation without compromise: removal by the date set by the deprecating body, announced in advance. Where BeatQuantum provides contractual services in more than one jurisdiction, the earliest remove-by date applies.
• Mechanism: key-exchange algorithms are one server-ordered list, so removing one is a single configuration change with no change needed on the client, which moves to its next supported option. Every change is verified externally, one algorithm at a time, and recorded in an updated cryptographic bill of materials.

Source. These commitments are the Cryptoagility Procedures of our Certificate Practice Statement, section 8.5, applied to this service. To report a vulnerability, see our security disclosure policy.