spt-pq-crypto
Post-quantum cryptographic primitives -- ML-KEM-768, ML-DSA-65, HQC, BLAKE3, and hybrid key exchange
Overview
spt-pq-crypto is the cryptographic foundation for the SPT platform, providing both post-quantum and classical primitives. It implements NIST FIPS 203 (ML-KEM-768) for key encapsulation, FIPS 204 (ML-DSA-65) for digital signatures, and HQC for code-based KEM at multiple security levels. A hybrid key exchange mode combines ML-KEM with X25519 for defense-in-depth. This crate is used by spt-dark, spt-onion, spt-srp, and other privacy/security crates.
Key Features
- ML-KEM-768 -- lattice-based key encapsulation (NIST FIPS 203) via
ml-kem - ML-DSA-65 -- lattice-based digital signatures (NIST FIPS 204) via
fips204, pure Rust - HQC -- code-based KEM at 128/192/256-bit security levels via
pqcrypto-hqc - Hybrid key exchange -- ML-KEM + X25519 combined key agreement
- BLAKE3 fingerprinting -- XOF-based 64-byte fingerprints with ML-DSA signatures
- Classical crypto -- Ed25519 signatures, X25519 ECDH, ChaCha20-Poly1305 AEAD, HKDF-SHA256
- Memory safety -- zeroize-on-drop for all secret key material via
zeroize
Dependencies
No internal SPT crate dependencies. All cryptographic implementations come from audited external crates (ml-kem, fips204, pqcrypto-hqc, ed25519-dalek, x25519-dalek, chacha20poly1305).
Usage
rust
use spt_pq_crypto::{MlKem768, MlDsa, Hqc128, Fingerprint};
// ML-KEM key encapsulation
let (pk, sk) = MlKem768::generate_keypair();
let (ct, ss) = MlKem768::encapsulate(&pk);
// ML-DSA signing
let kp = MlDsa::generate_keypair();API Reference
Core Types
| Type | Description |
|---|---|
MlKem768 | ML-KEM-768 key encapsulation mechanism |
MlDsa | ML-DSA-65 digital signature scheme |
MlDsaKeyPair | ML-DSA signing/verification key pair |
Hqc128 / Hqc192 / Hqc256 | HQC KEM at different security levels |
KeyPair | Generic KEM key pair |
SharedSecret | Shared secret from key encapsulation |
Ciphertext | KEM ciphertext |
Fingerprint | BLAKE3-based 64-byte fingerprint |
CryptoError | Crate error type |