Second layer, not a replacement
Sits on top of TLS, Tailscale, SSO, and disk encryption. When the envelope is off, your stack keeps working.
Security product · Metal · II
Jet planes
Second layer over the fleet. TLS stays on public APIs.
Security product · Omnific LLC
Omni-Encryption
Second-layer authenticated encryption for AI agent fleets and control planes. Hybrid PQC mutual handshake is shipped — then steady-state traffic rides AES-256-GCM with session, causal, and rekey controls. Domain labels separate transcripts only — no magic hardness claims.
v0.7.0 · Protocol v3 · Hybrid PQC mutual · AES-256-GCM · Fleet SL2 · Identity pins · TLS boundary · Red-team 26/26 held (lab)
Why teams buy it
Built for agent fleets
Session-bound AEAD, authenticated rekey, causal sequencing, and anti-replay — designed for live agent and control-plane traffic.
Hybrid PQC mutual bootstrap — shipped
X25519 + ML-KEM-1024 (FIPS 203) + ML-DSA-87 (FIPS 204). Both peers authenticate; KEM combine is transcript-bound to suite + identity pubs. Pins stay out-of-band.
Honest crypto claims
Data-plane confidentiality rests on AES-256-GCM. Phoenix A* bounds document adversary budgets — they do not invent free hardness. PQC covers handshake, not AES lifetime.
Measured, not mystical
Benchmarked against AES-GCM, ChaCha20-Poly1305, and SHA-256. PQC is a once-per-session cost; steady-state matches PSK Omni. Red-team: 26/26 held (lab suite).
Crypto-agility
Handshake suite registry (SHA-512 / SHA3-512). Retire a primitive by adding a suite — never mutate a shipped id.
At-rest vault + domain labels
Classified method bodies seal at rest with off-model keys. Domain-separation labels bind transcripts only — they never mint entropy or replace AES-GCM.
TLS boundary for public APIs
Omni is second-layer for fleets. Public third-party HTTPS uses standard TLS only; fleet wrap is refused on SaaS/public hosts.
Identity pins you operate
Peer identity pins are out-of-band. Prefer explicit pins; TOFU accepts first contact only if that channel is trusted. Silent pin rotation is rejected.
Architecture at a glance
1 · Bootstrap (PQC)
Mutual handshake: hybrid KEM + dual ML-DSA signatures. Shared secret → OmniKey. Wire ≈ 8.8 KiB once. Identity pins out-of-band (TOFU / PKI / fingerprint).
2 · Data plane (v3)
AES-256-GCM with topology, spin domain, directional causal transcript, counter nonces, two-phase anti-replay, prepare/apply/commit rekey.
3 · Fleet SL2
Optional second-layer envelopes for multi-service fleets — chat, RPC, HTTP JSON, audit, KV — with bounded shadow telemetry on rejects.
4 · Vault + TLS boundary
Classified method bodies seal at rest with off-model keys. Domain labels are public AAD only. Public third-party APIs use standard TLS — Omni is not wrapped onto SaaS/public HTTPS hosts.
Performance you can show a buyer
Fair baseline is AES-256-GCM (encryption),
not SHA-256 (hash only). Lab host: Apple Silicon · Python 3.12 ·
aios-omni-encryption bench (2026-07-17).
Setup (once per peer / session)
~1.1 msPeerIdentity keygen
~12 msPQC mutual handshake
~0.04 msPSK PeerPair create
~300×PQC vs PSK setup tax
Steady-state (encrypt+decrypt @ 1 KiB)
~401kAES-GCM rt/s @ 1 KiB
~293kChaCha20-Poly1305 @ 1 KiB
~64kOmni SL2 @ 1 KiB (~6×)
~19kOmni v3 @ 1 KiB (~21×)
~19kOmni after PQC (same path)
~1.7MSHA-256 hash/s (not AEAD)
Headlines: PQC mutual handshake ≈ 12 ms once.
After that, Omni with a PQC-derived root is within ~3% of PSK Omni
(~19k rt/s @ 1 KiB, ~21× raw AES). ML-KEM/ML-DSA do not run per message.
Amortization · 1 KiB messages including one PQC handshake
| Messages after handshake | Effective ms/msg | vs AES (~0.002 ms) |
|---|---|---|
| 1 | 12.2 | setup-dominated |
| 10 | 1.3 | still amortizing |
| 100 | 0.17 | control-plane ready |
| 1,000 | 0.06 | ≈ Omni steady-state |
| 10,000 | 0.05 | ≈ Omni steady-state |
Not an SLO — regenerate on deployment hardware with
uv run python -m aios_omni_encryption bench.
For bulk multi-GB streams prefer raw AES/TLS; reserve Omni + PQC for agent/control channels.
Ship in four steps
01
Generate peer identities (or fleet key)
PeerIdentity.generate() for mutual PQC · or omni-encryption gen-key for SL2 master key
02
Bootstrap the session
PeerPair.create_authenticated(alice, bob) · or export OMNI_SECOND_LAYER=1 for SL2 envelopes
03
Wrap at the edge
Adapters: chat hub, agent RPC, HTTP JSON, audit logs, KV buses · duplex PeerPair for live agents
04
Observe & rekey
Shadow telemetry flags probes · prepare/apply/commit rekey · CLI: handshake-demo · bench · redteam · interop · pin-surface · crypto-maturity
Packaging
Lab
Open core
Self-host the library, run benches, handshake demo, and red-team locally.
- Cumulative package 0.7.0 (protocol v3 + hybrid PQC + pin lifecycle)
- Protocol v3 AEAD + hybrid PQC mutual (X25519 + ML-KEM + ML-DSA)
- Cascade AEAD option · surpass key policy (RSA ≥3072, ECIES dual-DEM)
- At-rest sealed method envelopes · identity pin store (explicit / TOFU)
- TLS boundary: public third-party APIs stay standard TLS only
- Hybrid PQC maturity honesty · AES-256-GCM data plane
Fleet
Contact sales
Second-layer protection across agent, chat, and internal APIs.
- Shared master-key SL2 for multi-service fleets
- Adapters: chat hub, agent RPC, audit, KV, HTTP JSON
- Session duplex (PeerPair) with optional PQC mutual bootstrap
- Probe shadow telemetry without silent key rewrite
- Deployment guidance + claim-disciplined security brief
Sovereign
Enterprise
Air-gapped and hybrid estates with patent-aligned process packaging.
- Air-gap / hybrid hardened OS packaging path
- Custom domain separation & session policy
- Pinned-identity rollout (TOFU / PKI) for mutual PQC
- Architecture review + red-team campaign support
- IP / process-claim documentation pack
What it is not
Omni-Encryption does not replace TLS, disk encryption, or public CA trust. It does not claim black-hole math as cryptographic hardness, FTL keys, or “unbreakable by quantum computers” for the AES data plane. Hybrid PQC authenticates and bootstraps peers; generic classical confidentiality remains AES-256. Domain-separation labels never mint entropy or capability. Public third-party APIs stay on standard TLS. Identity pins are obtained out-of-band (operator-managed). Use it as a second layer on live internal agent and control traffic — where mutual session bootstrap, session death, and probe telemetry matter.