๐ pqguard
Post-quantum file encryption CLI โ ML-KEM-768 (FIPS 203) + AES-256-GCM.
Encrypt files using NIST-standardized post-quantum algorithms that resist both classical and quantum computer attacks.
Project status: production-quality Rust cryptography, NIST FIPS 203 compliant, fuzz-tested, published on crates.io.
๐ฏ What it doesโ
| Capability | Description |
|---|---|
| Post-quantum key exchange | ML-KEM-768 (Kyber768) โ NIST Level 3, resists Shor's algorithm |
| Hybrid encryption | KEM + HKDF-SHA256 + AES-256-GCM โ industry-standard symmetric layer |
| CLI interface | keygen, encrypt, decrypt, verify, info commands |
| Key management | Named keypairs with public/private separation |
| File verification | Integrity check without decryption |
| NIST compliance | FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) |
โ๏ธ Architectureโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ ENCRYPTION โ
โ โ
โ 1. Generate random salt + nonce โ
โ 2. ML-KEM-768 encapsulate โ shared secret + ct โ
โ 3. HKDF-SHA256(shared_secret, salt) โ aes_key โ
โ 4. AES-256-GCM(aes_key, nonce, plaintext) โ ct โ
โ 5. Write: PQGR โ version โ kem_ct โ nonce โ โ
โ salt โ aes_ct โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ DECRYPTION โ
โ โ
โ 1. Parse PQGR envelope โ
โ 2. ML-KEM-768 decapsulate(ct, dk) โ shared_secret โ
โ 3. HKDF-SHA256(shared_secret, salt) โ aes_key โ
โ 4. AES-256-GCM decrypt(aes_key, nonce, aes_ct) โ
โ 5. Output plaintext โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Quick startโ
# Install
cargo install pqguard
# Generate keypair
pqguard keygen
# Encrypt a file
pqguard encrypt secret.txt --recipient public_key.pqg.pub
# Multi-recipient โ any listed private key can decrypt
pqguard encrypt secret.txt -r alice.pqg.pub -r bob.pqg.pub
# Decrypt
pqguard decrypt secret.pqg --private-key private_key.pqg.key
๐ Commandsโ
| Command | Description |
|---|---|
pqguard keygen | Generate ML-KEM-768 keypair |
pqguard encrypt <file> -r <pubkey> | Encrypt file for one recipient |
pqguard encrypt <file> -r <a> -r <b> | Multi-recipient (v2 envelope) |
pqguard decrypt <file> -k <privkey> | Decrypt file with private key |
pqguard verify <file> | Verify pqguard file integrity |
pqguard info <keyfile> | Show key information |
๐ Algorithm Detailsโ
| Component | Algorithm | Standard |
|---|---|---|
| Key Exchange | ML-KEM-768 (Kyber768) | NIST FIPS 203 |
| Key Derivation | HKDF-SHA256 | RFC 5869 |
| Symmetric Encryption | AES-256-GCM | NIST SP 800-38D |
๐ Benchmarksโ
| Operation | Time |
|---|---|
| Keygen | ~150ฮผs |
| Encapsulate | ~25ฮผs |
| Decapsulate | ~30ฮผs |
| AES-256-GCM (1MB) | ~0.5ms |
๐งช Why Post-Quantum?โ
Classical cryptography (RSA, ECDH) will be broken by quantum computers running Shor's algorithm. NIST finalized post-quantum standards in 2024:
- ML-KEM (FIPS 203) โ Key encapsulation
- ML-DSA (FIPS 204) โ Digital signatures
- SLH-DSA (FIPS 205) โ Hash-based signatures
The "harvest now, decrypt later" threat means data encrypted today with classical algorithms can be decrypted by future quantum computers. pqguard protects against this.