Industries · Defence

Every order signed. Every action provable.

Naval, air, land and uncrewed forces are being connected, automated and contested at once. R-Series gives every order, every autonomous decision and every firmware change a hybrid post-quantum receipt that verifies offline, keeps working when the link is jammed, and still checks at the after-action review.

Book a briefing See the domains

SignaturesEd25519 + ML-DSA-65 or -87

Designed forDenied, disconnected links

StatusIn development

In a contested theatre the link fails first. The evidence must not.

01 Why defence is different

Speed, autonomy and an adversary in the loop.

Commercial systems worry about fraud. Defence systems assume an adversary who listens, spoofs, jams and waits. Orders cross radio, satellite and mesh links that can be intercepted today and decrypted later. Uncrewed platforms are told to keep operating when the link drops. Firmware moves through long supply chains. And every action may be examined months later, by commanders, by inspectors, by allies or by a court.

R-Series turns each of those moments into a receipt: what was ordered, by which authority, under which rules, what the platform did, and which key signed it. Receipts are hash-chained, so a missing or altered entry shows. They carry a classical and a post-quantum signature, so a record made today still holds when quantum computers arrive. And they verify with the issuer's public keys, on an air-gapped laptop, with no call to DCS.

We build the trust layer, not weapons. The nation keeps the keys, the hardware and the decision.

02 Threats we design against

Six ways a force loses the truth.

HARVEST NOW, DECRYPT LATER

Traffic recorded today

Adversaries store encrypted orders and telemetry now, to read them once a quantum computer can.

Hybrid post-quantum signatures on every record; post-quantum key exchange for the transport.

SPOOFED ORDERS

Forged or replayed commands

A captured message replayed an hour later, or an order that never came from the commander.

Each order is signed, bound to its issuer's key epoch and chained; replays and forgeries are refused and logged.

LINK DENIAL

Jamming and electronic warfare

The link to a drone or a forward unit drops for minutes or hours, exactly when it matters.

Bounded autonomy inside signed limits; every decision sealed on board and forwarded when the link returns.

TAMPERED FIRMWARE

Implants in the supply chain

A changed image on a radio, a seeker or a vehicle computer, inserted anywhere between factory and field.

Signed firmware checked against its digest before it is flashed; the flash itself becomes a receipt.

INSIDER CHANGE

Quiet edits to the record

A log entry removed or a time changed after the fact, by someone with access.

Hash chains, clock-skew limits and an append-only log: a gap or an edit is visible to any verifier.

COALITION FRICTION

Allies who cannot check

A partner must rely on your data without access to your networks or your systems.

Hand over a chain and a public key; the partner verifies offline, with open algorithms.

03 One theatre, end to end

From the order to the after-action review.

Theatre01 / 05

01 · ORDERS

Every order leaves a signed trail.

The command post signs each order with Ed25519 and ML-DSA-65. Ship, armour, aircraft and drones verify it before acting, and each verification lands in a hash-chained ledger.

Issuer, authority and rules of engagement reference bound into the receipt
Keys held in the nation's own key store

02 · LINK DENIED

Jammed, but not blind.

Electronic warfare cuts the drone's link. It continues inside the limits it was given in advance, signed by its commander, and seals every decision on board as a receipt.

Nothing outside the signed bounds
Each on-board receipt chained to the last

03 · RESTORED

The backlog comes home, intact.

When the link returns the drone forwards its sealed backlog. The command post verifies every entry and the chain: no gaps, no edits, no reordering.

04 · FIRMWARE

Nothing unsigned is flashed.

A firmware update for a vehicle computer is checked against its signed digest before it is installed. A tampered image is refused, and the refusal is itself a receipt.

05 · AFTER ACTION

An ally verifies without your network.

The chain is exported to a coalition partner, who verifies it offline with the issuer's public keys. No call home, no shared network, no trust in our servers.

04 Domains

Sea, air, land, uncrewed, command and supply.

The same receipt works across every service. These are the places we design for. They describe where a receipt adds value, not deployments we have completed.

NAVY

Naval forces

Ship-to-shore and ship-to-ship orders, signed and checked
Long patrols with intermittent links: store, seal, forward
Combat-system and navigation software changes on record

AIR FORCE

Air and airborne C2

Taskings and mission changes receipted end to end
Maintenance and airworthiness records that last the airframe's life
Mission-data and avionics loads checked before use

ARMY

Land forces and armour

Orders to vehicles and units across tactical radio
Vehicle-computer and fire-control firmware checked before flashing
Who changed what, in which workshop, on record

UNCREWED SYSTEMS

Drones and autonomy

Signed mission bounds before launch
Every autonomous decision sealed on board, even when jammed
A verifiable flight record after recovery

COMMAND AND CONTROL

Headquarters and C2

Department-held keys, epochs and revocation
AI-assisted planning steps receipted, with the human approval on record
An append-only log for the after-action review

LOGISTICS AND SUSTAINMENT

Supply chain

What was shipped, received, flashed and repaired
Parts provenance from factory to field
Migration evidence as systems move to post-quantum keys

05 Post-quantum links

QKD and post-quantum cryptography, working together.

Quantum key distribution sends key material as single photons, and an eavesdropper on the fibre shows up as errors. But QKD still needs an authenticated classical channel, and it does not reach a drone, a ship or a vehicle. Post-quantum signatures authenticate that channel; post-quantum key exchange covers every link QKD cannot. R-Series records each key event, so a rejected batch is evidence, not a mystery.

AUTHENTICATE

Signed classical channel

Basis, check and confirm messages carry post-quantum signatures, so a man in the middle cannot pose as either site.

COMBINE

Hybrid session keys

Where both exist, the session key is derived from QKD material and a post-quantum key exchange together. Breaking one is not enough.

RECORD

Key events as receipts

Batches agreed, discarded and consumed are receipted, so key management can be reviewed after the fact.

Several national agencies prefer post-quantum cryptography to QKD for most uses, and some deployments will use only one. R-Series supports either posture. We do not build QKD hardware; we work with the equipment a programme already uses. Planned

06 The defence profile

ML-DSA-65 or ML-DSA-87. You choose.

Every receipt carries two signatures: a classical Ed25519 signature and a post-quantum ML-DSA signature. A deployment chooses the post-quantum strength. Ed25519 + ML-DSA-65 is the default, the right balance of size and strength for most records. Ed25519 + ML-DSA-87, the highest ML-DSA security level (FIPS 204) and the one CNSA 2.0 names for national-security systems, is the defence profile.

Both are hybrid: a forger would have to break the classical and the post-quantum signature at once. A programme can run both side by side, keep one per system, or move from one to the other with signed migration evidence. ML-KEM-1024 for transport and hash-based signatures (LMS / XMSS) for firmware, with state held in a hardware security module, complete the defence profile.

Profile	Receipt signature	Key exchange (transport)	Firmware	State
Default	Ed25519 + ML-DSA-65 (hybrid)	X25519 + ML-KEM-768	—	In development
Defence / national security	Ed25519 + ML-DSA-87 (hybrid)	ML-KEM-1024	LMS / XMSS, state in an HSM	In development
Long-horizon archive	Hash-based (SLH-DSA)	—	—	Planned

07 Built for denied, disconnected links

Assume the network is gone.

Defence systems run in disconnected, intermittent and limited-bandwidth conditions. Every property below is designed so a receipt keeps its meaning without a network.

0network calls needed to verify a receiptOffline verification

2signatures on every record: one classical, one post-quantumHybrid by design

3independent verifiers, in JavaScript, Python and Go, that must agreeNo single point of trust

1missing entry is enough for the chain to show a gapHash-chained

STORE · SEAL · FORWARD

Receipts made at the edge

A platform without a link seals its own receipts and forwards them later; the command post checks every entry on arrival.

DENY BY DEFAULT

Unknown means refused

An unknown key, an inactive key, a clock outside its limits or a missing log entry is refused, never waved through.

SMALL ENOUGH

Fits constrained links

Receipts carry hashes, not payloads, so the evidence travels even when the data cannot.

08 Clear lines

What we build, and what we don't.

WE BUILD

The trust layer

Signed, chained receipts for orders, decisions and changes
Offline verifiers anyone can run
Key lifecycle, epochs and revocation
Post-quantum migration with evidence
Integration with your radios, platforms and C2 software

WE DON'T

Weapons, or your decisions

No weapons, targeting or fire-control logic
No electronic-warfare hardware; we work with partners and your equipment
No keys held by DCS: the nation holds them
No claim of certification before an accredited body grants it
Human command authority stays explicit, and on record

How defence work starts. Defence engagements proceed only under the required government permissions, export rules and tender terms of the country concerned. Deployments can run fully on-premises and air-gapped, on the customer's own infrastructure.

09 Working with a defence programme

From a closed briefing to a programme, in stages.

STAGE 1

Closed briefing

The receipt format, the verifier and the honest state of every layer.

STAGE 2

Verify it yourselves

Your team checks sample receipts offline, on your own machines.

STAGE 3

Lab evaluation

On your hardware, air-gapped, against your own test cases and red team.

STAGE 4

Exercise shadow

Receipts emitted alongside one exercise, observe-only, with no effect on operations.

STAGE 5

Programme

Integration into a named system, under the programme's own accreditation.

10 Questions

From defence teams.

Can it run fully air-gapped?

Yes, by design. Receipts, verifiers and logs run where you choose, with keys in your own key store. Verification needs only the issuer's public keys and the public verifier.

What happens to a drone that loses its link?

It continues only within the bounds its commander signed before launch, seals each decision as a receipt on board, and forwards the backlog when the link returns. The command post verifies every entry and the chain.

Is this a weapons system?

No. R-Series records and verifies orders, decisions and changes. It contains no weapons, targeting or fire-control logic, and it does not decide anything on its own.

ML-DSA-65 or ML-DSA-87?

Both, as hybrids with Ed25519, chosen per deployment. ML-DSA-65 is the default; ML-DSA-87 is the defence profile, aligned with the CNSA 2.0 algorithm choices for national-security systems. Signatures are larger with ML-DSA-87, so we size links and storage for it in the evaluation stage.

Do you build QKD?

No. We authenticate and record key events for the QKD equipment a programme already uses, and cover the links QKD cannot reach with post-quantum cryptography.

Which certifications do you hold?

None are claimed yet. Certifications and accreditations are shown as pending until an accredited body has granted them.

Who holds the keys?

You do. DCS never holds a customer's signing keys, and a receipt never needs DCS to be reachable.

When the after-action review comes, the record should already be true.

Signed orders, bounded autonomy, checked firmware and offline evidence: a trust layer for forces that operate where the network does not.

Book a briefing Government Aerospace & aviation

In development — talk to us about a design partnership.

Want the details for your programme? Book a briefing — we share the full design and a live demo in a private session.