Defence
Post-quantum mission networks, up in minutes.
Connect sensors, vehicles and command systems into one sovereign network on equipment already in service. No new hardware, no vendor console overseas, and post-quantum encryption from the first packet.
- Time to deploy
- Minutes
- New hardware
- None
- Root of trust
- Yours
- Post-quantum
- ML-KEM-1024 · ML-DSA-87
Ready in minutes. Gone when you're done.
A secure network used to take a procurement cycle. With VeilNet it takes one command per device, the same day, alongside the kit you already run.
Hardware agnostic
Runs on Linux, Windows, macOS, FreeBSD and OpenBSD, on amd64 and arm64. It also runs over a field radio or a serial cable, with no IP network beneath it.
Rapid deployment
Commission a device in your guardian and one command enrols it. It finds the network in under a minute, with no vendor to call.
Ephemeral mission networks
Stand up a network for one mission, then revoke its devices and archive it. On each device, one command removes the service, the configuration and the identity.
Unified control across domains
Run air, land and sea from one console you host. Share one network with compartments, or give each domain its own sub-realm where data must never cross.
Built for contested links.
Links drop without warning. VeilNet measures every route it has, steps around a failure on its own, and gets through NAT on its own.
Instant failover
Run two gateways for the same network. When one stops, or its traffic fails for two seconds, its flows move to the other, with no one at a console.
Unique device IDs
A device's ID is a SHA3-256 hash of its ML-DSA-87 public key, and its IPv6 address comes from that ID. It never rotates, so a device stays itself through reboots and moves.
Authenticated NAT and firewall traversal
Devices connect directly, by hole punching or through a relay, across host-nation networks and coalition links. Anyone without a valid credential gets no reply at all.
Multipathing
Every route is costed by measured round-trip time, and traffic takes the cheapest. If a direct path isn't up within 250 ms, a relayed one is built alongside it.
The US sets 2030 for post-quantum key exchange and 2031 for signatures. Coalition networks will need both.
Source: US Executive Order 14412 ↗Security you can verify, not assume.
Every connection is encrypted and every device authenticated against nation-state adversaries, including those recording traffic today to decrypt later. Verify all of it on your own equipment.
End-to-end encryption
Traffic is encrypted twice: hop by hop with TLS 1.3, and end to end with ML-KEM-1024 and AES-256-GCM. A relay never holds a key that opens it.
Zero-trust authentication
A device knocks with its credential chain and an ML-DSA signature, then proves membership. No data moves until every check passes, and each peer runs them itself.
Smarter permissions
Taints split a network into compartments. A liaison's device can carry two units' taints and reach both, while the units still can't reach each other.
Post-quantum protection
NIST category 5 by default, the highest level: ML-KEM-1024 for key exchange and ML-DSA-87 for identity. Post-quantum key exchange is required, not just preferred.
Need a network that holds when the links don't?
Start with an assessment of the links most likely to fail: what has no post-quantum protection today, what changes with VeilNet, and what each option costs. VeilNet can run fully air-gapped.