Post-quantum security · as of 24 Sep 2026
Post-quantum encryption is a new generation of encryption, designed to withstand not only today’s computers but future quantum ones as well. Kioskbase uses it where the most sensitive thing on a tablet is at stake — the sign-in — and the Kioskbase website, portal and server offer it to every modern browser.
Why it matters
A quantum computer able to break today’s encryption does not exist yet. The threat, however, starts today:
That is why regulators are planning for it: the US NIST proposes to deprecate classic asymmetric cryptography (RSA, ECC) around 2030 and disallow it around 2035. The European Union’s coordinated roadmap of June 2025 recommends starting the transition by the end of 2026 and moving critical systems by 2030.
What exactly we have
When you replace a tablet, the saved sign-in to the web app the tablet displays moves from the old tablet to the new one, encrypted end to end with a post-quantum hybrid. The server only carries an encrypted package it cannot open itself, and the package expires after 10 minutes.
So the contents of a backup leave the tablet only when moved to a replacement tablet — and then only encrypted. Since Kioskbase 1.25.0 for Android.
These addresses offer a hybrid post-quantum key exchange (verified 24 September 2026): kioskbase.skkioskbase.comportal.kioskbase.skportal.kioskbase.comapi.kioskbase.com
The customer portal in a modern browser — Chrome and Edge on desktop from version 131, Firefox on desktop from 132, Safari from iOS and macOS 26 — uses it automatically. An older browser still connects encrypted as before, just without the post-quantum part. Which browsers protect you →
In the upcoming version, the Kioskbase app for Mac, iPad and iPhone connects to the Kioskbase server with a post-quantum key exchange only; a server that does not support it is refused. When pairing with an attendance system it prefers the post-quantum exchange — with dochadzka.online it does negotiate it.
Kioskbase is managed from Modulo, whose admin (admin.modulocms.sk) also runs with a post-quantum key exchange. The full overview is at modulocms.com/security.
Companies without post-quantum protection send data today that someone can store and read later, and the transition is still ahead of them. With Kioskbase, the sign-in transfer is already protected against that — with nothing to set up and nothing you need to know about. And when a customer or an auditor asks, you have a specific answer.
Website certificates: certificate authorities do not issue post-quantum certificates yet. A certificate only proves the server’s identity at the moment of connecting; it has no bearing on “harvest now, decrypt later”.
The app’s installation package is signed with a classic signature. The post-quantum-only connection of the Mac, iPad and iPhone app comes with the upcoming version; once it is out, we will add the date here.
Questions
No. The app encrypts the sign-in transfer on its own, from version 1.25.0 for Android. For the portal, an up-to-date browser is enough.
No. The server only carries an encrypted package that only the new tablet can open. The package expires after 10 minutes.
No, and we do not call it that. The connection is also protected against a threat that classic encryption does not account for. Hence the hybrid: the classic and the new method together, so if one turns out weak, the other still protects.
The easiest way is at the top of this page: if your browser negotiated post-quantum encryption, you will see a green badge. By hand: open portal.kioskbase.com/cdn-cgi/trace — the line kex=X25519MLKEM768 means your connection is running post-quantum right now. Which browsers support it and since which version is on the page Which browsers protect you.
As of 24 September 2026. When another part is added, we will list it here with a date.
Kioskbase