Session-based chunk-level video encryption API. Every video frame is individually encrypted with AES-256-GCM under a Kyber-derived session key. Every chunk is tracked in a Dilithium-signed manifest. Key rotation happens mid-stream with forward secrecy. Your infrastructure handles the video — H33 handles the cryptography.
Get API KeySix API calls. Create a session, exchange keys, encrypt chunks, rotate keys, sign the manifest, destroy everything.
Every video chunk passes through post-quantum key exchange, authenticated encryption, and digital signature attestation.
SHA3-256("H33_PQ_VIDEO_AES_KEY:" || shared_secret) to derive the AES-256-GCM session key. The Kyber lattice problem provides NIST Level 3 post-quantum security.
[sequence_number LE 4B][rotation_sequence LE 4B][0000 4B]. Additional Authenticated Data (AAD) is the constant string "h33-pq-video". This guarantees nonce uniqueness across chunks and key rotations without random collisions.
Mid-stream key rotation with graceful transition. Old keys are zeroized after the rotation boundary passes.
POST /session/{id}/rotate. Server generates 32 bytes of fresh randomness for the new AES key.previous_aes_key. Chunks with sequence_number < effective_after_chunk still decrypt with the old key. Both keys active simultaneously.sequence_number > effective_after_chunk, the old key is securely zeroized via Zeroize. Forward secrecy achieved — compromising the new key cannot decrypt old chunks.DELETE /session/{id}, the entire VideoSession struct is dropped with ZeroizeOnDrop. All key material — Kyber SK, AES keys, Dilithium SK — securely erased.Every encrypted chunk uses a deterministic 12-byte nonce constructed from the sequence and rotation numbers.
Watch a simulated PQ Video session: key exchange, chunk encryption, rotation, and manifest signing.
Measured on Graviton4 (c8g.metal-48xl). All operations are sub-millisecond.
Six endpoints. Session-based. All key material is zeroized on session destroy.
Generates a Kyber-768 keypair and a Dilithium-3 signing keypair. Returns the session ID and Kyber public key (base64).
{
"session_id": "vs_a1b2c3d4e5f6...",
"kyber_public_key": "MIIBIjANBgkq...",
"created_at": "1741651200"
}curl -X POST https://api.h33.ai/api/v1/video/session/create \ -H "Authorization: Bearer $H33_API_KEY"
Client sends their Kyber public key. Server encapsulates a shared secret and derives the AES-256-GCM session key via SHA3-256("H33_PQ_VIDEO_AES_KEY:" || shared_secret).
{
"client_public_key": "base64-encoded Kyber-768 public key"
}{
"encapsulated_key": "base64-encoded Kyber ciphertext (1,088 bytes)",
"rotation_sequence": 0
}Encrypts a video chunk with AES-256-GCM. Nonce is constructed from sequence_number and rotation_sequence. Each chunk gets a Dilithium-signed manifest entry.
{
"session_id": "vs_a1b2c3d4e5f6...",
"chunk_data": "base64-encoded raw video chunk",
"sequence_number": 0
}{
"encrypted_chunk": "base64-encoded AES-256-GCM ciphertext",
"manifest_entry": {
"chunk_hash": "SHA3-256 hex digest",
"sequence_number": 0,
"rotation_sequence": 0,
"timestamp": "1741651230",
"dilithium_signature": "base64 (3,309 bytes)"
}
}Generates a new random 32-byte AES key. Old key preserved until effective_after_chunk boundary passes, then zeroized.
{
"encapsulated_key": "base64-encoded new AES key",
"rotation_sequence": 1,
"effective_after_chunk": 42
}Returns all manifest entries for the session, plus a Dilithium signature over the entire serialized manifest JSON.
{
"session_id": "vs_a1b2c3d4e5f6...",
"entries": [
{
"chunk_hash": "a3f2...",
"sequence_number": 0,
"rotation_sequence": 0,
"timestamp": "1741651230",
"dilithium_signature": "..."
}
],
"manifest_signature": "base64 ML-DSA-65 over full manifest"
}Removes the session from the DashMap. The VideoSession struct implements ZeroizeOnDrop, so all key material (Kyber SK, AES keys, Dilithium SK) is securely erased when dropped.
204 No Content
curl -X DELETE https://api.h33.ai/api/v1/video/session/vs_a1b2c3d4... \ -H "Authorization: Bearer $H33_API_KEY"
Calculate the total encrypted output size and overhead for your video stream.
PQ Video costs 8 units per minute of session time. Signed transcripts cost 10 units per minute.
H33 PQ Video vs existing video encryption approaches.
| Feature | H33 PQ Video | Zoom E2EE | Signal Video | Google Meet |
|---|---|---|---|---|
| Key Exchange | ML-KEM-768 (PQ) | ECDH P-256 | X25519 | TLS 1.3 (ECDH) |
| Post-Quantum Secure | Yes | No | No | No |
| Per-Chunk Encryption | Yes (AES-256-GCM) | Per-frame (AES-256-GCM) | Per-frame (AES-256-CBC) | Transport-level only |
| Signed Manifest | ML-DSA-65 (PQ) | No | No | No |
| Key Rotation | Mid-stream + forward secrecy | Session-based | Ratchet-based | Connection-level |
| Key Zeroization | ZeroizeOnDrop (Rust) | Platform-dependent | Best-effort | Not specified |
| Bring Your Own Infra | Yes — API only | Zoom only | Signal only | Google only |
| Audit Trail | Per-chunk Dilithium-signed | Metadata only | No | Admin console logs |
Chunk-level post-quantum video encryption for every industry that handles sensitive recordings.
Feature-level comparison against enterprise video and file encryption platforms.
| Feature | H33 PQ-Video | Virtru | Tresorit | AWS Wickr |
|---|---|---|---|---|
| Encryption Level | Chunk-level (per-chunk keys) | File-level | File-level | Message-level |
| Key Exchange | ML-KEM-768 (PQ) | RSA / ECDH | RSA | ECDH |
| Attestation | ML-DSA-65 (Dilithium) | None | None | None |
| Post-Quantum | Full (KEM + signatures) | No | No | No |
| Forward Secrecy | Per-chunk rotation | Session-level | No | Session-level |
| Manifest Signing | Dilithium-signed | No | No | No |
| API Model | REST API (chunk streaming) | SDK / Portal | Desktop app | SDK |
| Video-Specific | Yes (chunk envelope, frame timing) | No (generic file) | No (generic file) | Yes (real-time) |
| Audit Trail | Cryptographic (on-chain optional) | Policy-based | Logs | Logs |
Technical details on chunk-level encryption, post-quantum primitives, and integration.