Two Dice One Shake (QED): A 100 % Quantum-Safe Dual-KEM Protocol for Sub-5 ms Data Transfer

Classical TLS will be broken the day practical quantum computers arrive. That threatens not just log-ins and banking but AI inference streams—the gRPC/HTTP pipes that move embeddings, model weights, or user prompts across GPU clusters.
“Two Dice One Shake” (TDOS) is a drop-in, production-ready fix: a dual-KEM handshake that fuses Kyber-1024 key exchange with Dilithium-3 signatures to deliver 100 % quantum-safe encryption over plain HTTP/1.1—no TLS termination, no service-mesh surgery.

In this live demo I’ll peel TDOS apart from the ground up:

1. Protocol Design – why rolling two independent KEMs (“the dice”) removes any single quantum-break point.
2. Implementation – Rust + OpenQuantumSafe bindings, compile-time guards that reject anything but NIST-exact key sizes, zero simulation fallbacks.
3. Performance – dual handshake in ≈ 4 ms, encrypted inference frames in < 1 ms; how async/await + zero-copy buffers keep your transformer payloads at line rate.
4. Verification Pipeline – a 10-stage CI suite that mathematically proves real PQC, hammers 100 + consecutive ops, and auto-fails on weak-crypto fall-backs.
5. AI-First Integration Paths – Axum/Tower middle-wares for Rust inference servers, Warp filters for fine-grained route control, plus Docker/K8s manifests so you can wrap a running model without touching your load-balancer.

We’ll finish by routing a live embedding stream through TDOS, Wireshark-sniffing 1568-byte Kyber packets, and showing how to bolt the state machine onto an ONNX-runtime micro-service in < 20 LOC.

Attendees leave with a reproducibility script, a working Axum demo, and a mental model for shipping quantum-safe AI APIs today, not “when NIST finalises.”