Quantropi, an Ottawa cybersecurity company, says on its product page that its QEEP cipher is “Powered by Quantropi’s Quantum Permutation Pad (QPP) technology, which achieves Shannon Perfect Secrecy.” Claude Shannon defined perfect secrecy in a 1949 paper as encryption that leaves an eavesdropper exactly as uncertain about a message after intercepting it as before. In that paper, he proved that perfect secrecy needs at least as many keys as there are possible messages.
For arbitrary data, such as files, any bit string of the data’s length is a possible message, so a key shorter than the data fails that condition. The one-time pad meets it with a key that is random, as long as the message, and used once. Two Quantropi researchers described a typical QPP built from a 32,768-bit key, about 4 kilobytes, and wrote that it can be reused.
A product sold as offering Shannon’s perfect secrecy with a key shorter than the data it protects, or with a key used more than once, claims what Shannon proved impossible for arbitrary data in 1949, so a buyer should treat that claim alone as the first warning sign.
QEEP may still resist practical attacks, as AES does. Security that depends on attackers lacking the computing power to search the keys is computational security, a conditional guarantee.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is the founder and CEO of Applied Quantum, a quantum systems integration and consulting firm, and the author of its PQC Migration Framework.
What Shannon proved
Shannon allowed the eavesdropper “unlimited time and manpower,” so a quantum computer adds nothing against a perfectly secret cipher. He proved the bound by counting alone. Decrypting one ciphertext under every possible key yields at most one candidate message per key. With fewer keys than possible messages, an eavesdropper who tries every key can rule some messages out and so learn something about the one sent.
In information theory, the key must carry at least as much entropy, or unpredictability in bits, as the message. Browsers distrusted eMudhra’s intermediate certificates in October 2026 after a researcher showed that their private keys, meant to be random numbers about 384 bits long, were whole numbers below 256, with at most 8 bits of entropy each. In its full incident report to Mozilla in November, eMudhra wrote that “the original on-board key pairs were generated correctly” and that a custom key-handling script “truncated the private value to its leading byte,” leaving a re-created weak key that was certified.
Perfect systems “may be used either where the greatest importance is attached to complete secrecy … or in cases where the number of possible messages is small,” Shannon wrote. He named “the equivalent amount of key that must be sent” as their disadvantage for large correspondence systems.
Three conditions and their costs
A key shorter than the message
For a system “with a finite key,” Shannon wrote, the set of messages an intercepted ciphertext could represent usually narrows as the eavesdropper collects more of it, until there is “a unique ‘solution’ to the cryptogram.” He called the amount of ciphertext needed to reach that point the unicity distance. Beyond that distance, a defender relies on the attacker lacking the computing power to find the key.
A key stretched from a short seed
Engineers usually stretch a short key into a long keystream with a pseudorandom generator, a deterministic procedure that produces random-looking output. AES in counter mode, as NIST specified it in 2001, is built this way. A keystream grown deterministically from a 256-bit key contains at most 256 bits of entropy, however long it grows.
A key used twice
An eavesdropper who holds two messages encrypted with the same pad can cancel the key by combining the two ciphertexts. In a history of the Venona project, the NSA wrote that the Soviet company that generated the KGB’s one-time pads “produced about 35,000 pages of duplicate key as a result of pressures brought by the German advance on Moscow.” American codebreakers exploited the duplicates. Of the many thousands of messages sent from 1940 through 1948, only about 3,000 “were even partially read and translated.”
Quantropi’s claim, condition by condition
Quantropi sells QEEP, short for Quantum Entropy Expansion and Propagation, as symmetric encryption. On its product page, the company says QEEP “extends the symmetric encryption key length well beyond the current 256-bit limit.” Quantropi gives no production key size or reuse policy for QEEP on that page or its analysis page.
Randy Kuang and Nicolas Bettenburg, both of Quantropi, described QPP in a paper for the 2020 IEEE International Conference on Quantum Computing and Engineering. A QPP replaces each byte of data with another according to one of several secret shuffles of the 256 possible byte values. For “a typical logical implementation,” the authors used 16 shuffles created from “a random stream of bits as long as 32,768 bits.” They wrote that the key grows with the number and size of the shuffles.
A shuffle of 256 values drawn at random contains at most about 1,684 bits of entropy, so 16 such shuffles total at most about 26,944 bits. By Shannon’s bound, no one can keep more than about 3,368 bytes of arbitrary data perfectly secret with the paper’s typical pad, or more data than the key’s length in any configuration.
Encrypting more than 16 bytes means reusing at least one of the 16 shuffles. Kuang and Bettenburg did not say which shuffle encrypts which byte. An eavesdropper who knows which bytes share a shuffle sees equal plaintext bytes in those positions produce the same ciphertext byte. The 3,368-byte ceiling follows from counting alone and holds without that knowledge.
Kuang and Bettenburg wrote that QPP “is also reusable without invalidating the perfect secrecy property,” a claim they made under an extended, quantum-mechanical definition. “The generalized Shannon perfect secrecy not only retains the perfect secrecy property, but gains reusability,” they wrote. A buyer who accepts that definition relies on a guarantee Shannon never proved. On its product page, Quantropi says QPP “achieves Shannon Perfect Secrecy” with no such qualifier, a claim a buyer can test against Shannon’s 1949 definition.
On an analysis page last updated on March 10, 2026, Quantropi wrote that “QEEP™ provides repeatable perfect secrecy at all endpoints, regardless of the communication medium.” A pad used for more than one message is a reused key, the weakness the Venona codebreakers exploited in one-time pads. Reuse removes the proof of perfect secrecy whether or not the same attack works on QEEP.
In a 2022 paper in Quantum Information Processing, Kuang and Michel Barbeau of Carleton University wrote that the method can run on “classical computers” and “today’s Internet,” and that “the key length can be anything greater than 256 bits.” Piotr Zawadzki analyzed QPP in the same journal in 2024, including a proposed practical device that pairs QPP with a pseudorandom number generator. Such a device contains no more entropy than the generator’s seed, whatever its output length. Zawadzki found that in simplified versions, an attacker who can choose the plaintexts that QPP encrypts can recover the encryption key.
Avval Amil of IIT Delhi and Shashank Gupta of QuNu Labs, a quantum-security company, analyzed QPP in an April 2023 preprint that has not been peer reviewed. They recommended 256 shuffles of at least 2,048 values each for practical use.
Where the short-key case has support
Quantropi’s position has a sound core. One byte encrypted once, with a shuffle drawn at random from every possible shuffle of 256 values, is perfectly secret in Shannon’s sense, because each ciphertext byte is then equally likely whatever the plaintext byte was.
On its analysis page, Quantropi says QEEP “is capable of high-throughput true random key exchange.” On its product page, it says QEEP “can be combined with AES in a FIPS compliant approach to provide defense-in-depth.” Quantropi attached no key size or reuse policy to either statement.
Zawadzki also wrote that “the described attack does not undermine the security of a complete implementation.” Breaking it would require attacking the generator and QPP together. With a key “well beyond” 256 bits, a brute-force search of QEEP’s keys may be out of reach. A buyer can accept all of that and still classify the guarantee as computational.
Cryptographers have proved real guarantees for shorter keys under weaker definitions. Yevgeniy Dodis and Adam Smith analyzed entropic security, a guarantee that the ciphertext reveals no function of a message to an attacker who is already uncertain about it. Their best scheme still needs a key almost as long as the message when an attacker can predict most of it, as with records in a known format.
Zixuan Hu and Zhenyu Li of the University of Science and Technology of China posted a preprint in August 2024, not peer reviewed, titled “Quantum encryption design overcomes Shannon’s theorem to achieve perfect secrecy with reusable keys.” In their design, the sender transmits qubits over a quantum channel to produce a one-time bit string for each message. A short pre-shared key “can be reused indefinitely,” the authors wrote. They also wrote that “Shannon’s theorem remains true in the classical regime.”
Questions for buyers
Buyers who need protection against unlimited computing power, called information-theoretic security, must deliver fresh random key as long as their data. A one-time pad consumes that much key, and quantum key distribution (QKD) is one way to deliver it, at the rate the link can generate key. For U.S. national security systems, the NSA still does not recommend QKD.
Buyers replacing quantum-vulnerable cryptography also have dates to meet. In its final transition plan, NIST deprecates RSA and elliptic-curve cryptography after 2030 and disallows both after 2035. A buyer can test a perfect-secrecy claim with five questions before buying. The first three need only arithmetic and the vendor’s own documents.
- Key length. Ask for the number of fresh, secret random key bits that the product consumes per bit of data, and how it generates them. For arbitrary data, Shannon proved that perfect secrecy needs at least one.
- Key source. Ask whether the key comes from a physical random source or from a generator that stretches a seed.
- Key reuse. Ask whether any key material encrypts more than one message. A product that reuses key material offers computational security at best and should be judged as a conventional symmetric cipher is.
- Proof. Ask which published theorem supports any claim beyond those three answers, in which model, and with what assumptions about the attacker and the data. Dodis and Smith proved their guarantee only for unpredictable data. Hu and Li built their design around a quantum channel.
- Outside analysis. Bruce Schneier wrote in 1998, of new ciphers in general, that “Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break.” Ask who outside the company has tried to break the cipher and where the results appeared. Zawadzki’s paper and Amil and Gupta’s preprint are the kind of documents a buyer should expect to see.
Public cryptanalysts can also revise an established verdict. In October 2026, Germany’s BSI advised against Classic McEliece in new systems, a scheme built on a 1978 design, after three research groups estimated key recovery below its claimed security.
What would change this assessment
This assessment would change if a vendor published a key consumption of at least one random bit per bit of data, with no reuse. Such a product would meet the key-length condition for a one-time pad, with the key-delivery cost Shannon described in 1949, and would still have to show that its keys are random, secret, and never reused.
It would also change if Quantropi described QEEP’s security as computational and submitted QEEP to an open, multi-year public review of the kind NIST ran for its post-quantum standards. Until then, buyers can read “Shannon Perfect Secrecy” on a product page as a claim that, under Shannon’s definition, cannot hold for arbitrary data longer than the key.
