Quantum Security Software Development Kit - Post-quantum cryptography SDK for hybrid security in production systems.
QuantSec SDK is a post-quantum cryptography SDK designed for gradual migration in real-world systems.
Quantum computers threaten current cryptography. When quantum computers become practical, algorithms like RSA, ECDSA, and ECDH will be broken. QuantSec provides:
- ✅ Hybrid signatures (Ed25519 + Dilithium3) - works today, secure tomorrow
- ✅ Post-quantum key exchange (X25519 + Kyber768) - quantum-resistant channels
- ✅ Identity management - versioned, rotatable, revocable identities
- ✅ Optional Blockchain anchoring - public trust anchor for identity verification
- ✅ Multi-language support - Node.js, Python, Go, Rust
QuantSec adds a security layer to your application:
Your Application
↓
QuantSec SDK (Security Layer)
↓
Your Existing Infrastructure
No architectural rewrites required. QuantSec integrates as a security layer.
git clone https://github.com/quantsec/quantsec-sdk
cd quantsec-sdk
cargo build --releaseuse quantsec_sdk::core::*;
fn main() -> Result<(), CryptoError> {
let identity = Identity::generate(CryptoPolicy::default());
let message = b"Hello, Quantum World!";
let signature = identity.sign(message)?;
assert!(identity.verify(message, &signature));
Ok(())
}See QUICKSTART.md for 5-minute integration guide.
QuantSec SDK is built in layers:
┌─────────────────────────────────────────┐
│ Language Bindings (Node.js/Python/Go) │
└──────────────┬──────────────────────────┘
│
┌──────────────▼──────────────────────────┐
│ C-ABI Interface (FFI) │
└──────────────┬──────────────────────────┘
│
┌──────────────▼──────────────────────────┐
│ Core SDK (Rust) │
│ - Identity Management │
│ - Hybrid Signatures │
│ - Secure Channels │
└──────────────┬──────────────────────────┘
│
┌──────────────▼──────────────────────────┐
│ Cryptographic Implementations │
│ - Ed25519 (Classical) │
│ - Dilithium3 (Post-Quantum) │
│ - Kyber768 (Post-Quantum KEM) │
└─────────────────────────────────────────┘
Key Principle: All cryptography happens in the Rust core. Bindings are thin wrappers. Bindings contain no cryptographic logic and cannot weaken security guarantees.
- Classical: Ed25519 signatures, X25519 key exchange
- Post-Quantum: Dilithium3 signatures, Kyber768 KEM
- Combined: Both must verify for security
- Generate, load, export identities
- Key rotation with version tracking
- Public identity descriptors
- Blockchain anchoring (optional)
- Hybrid key exchange (ECDH + Kyber)
- AES-256-GCM authenticated encryption
- Automatic key derivation (HKDF)
- Rust: Native API
- Node.js: N-API binding
- Python: pybind11 binding
- Go: cgo binding
- Smart contract registry (EVM)
- Identity anchoring
- Rotation tracking
- Revocation management
- Quick Start - Get started in 5 minutes
- Architecture - System design and components
- Threat Model - Security assumptions and guarantees
- Integration Guide - Add QuantSec to existing systems
- FAQ - Common questions
- Roadmap - Future development
cargo add quantsec-sdkcd bindings/nodejs
npm install
npm run buildcd bindings/python
pip install -e .import "github.com/quantsec/quantsec-sdk/bindings/go"let identity = Identity::generate(CryptoPolicy::default());
let message = b"Important message";
let signature = identity.sign(message)?;
assert!(identity.verify(message, &signature));let channel = SecureChannel::establish(local_identity, remote_public)?;
let ciphertext = channel.encrypt(b"Secret data");
let plaintext = channel
.decrypt(&ciphertext)
.expect("decryption failed");
assert_eq!(plaintext, b"Secret data");const helper = new QuantSecRegistryHelper(contract);
await helper.registerIdentity(identity, signer);
const status = await helper.isIdentityActive(identity);See examples/ for complete examples.
- ✅ Hybrid security: Classical + post-quantum algorithms
- ✅ No private keys on-chain: Only public descriptors
- ✅ Auditable: Event-based monitoring
- ✅ Versioned: Track key rotations
- ✅ Revocable: One-way revocation
- ❌ On-chain cryptography
- ❌ Privacy-preserving anonymity
- ❌ Replacement for TLS (yet)
See THREAT_MODEL.md for detailed security analysis.
- Signature size: ~3.3 KB (64 + 3293 bytes)
- Key generation: < 100ms
- Signing: < 10ms
- Verification: < 20ms
- Key exchange: < 50ms
Performance varies by platform and is subject to change.
Licensed under either of:
- Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
- API Stability: The public API is not stable and may change in future releases
- Security Audit: This version has not undergone formal security audit
- Production Use: Not recommended for production-critical applications without security audit
- Key Storage: Private keys are exported in plaintext (see SECURITY.md for details)
- ✅ Core cryptography implemented (Ed25519, Dilithium3, Kyber768)
- ✅ Multi-language bindings (Node.js, Python, Go)
- ✅ Blockchain integration (EVM smart contracts)
- ✅ Identity management with key rotation
- ✅ Secure channels with hybrid key exchange
- Breaking Changes: API may change before v1.0.0
- Bug Fixes: Critical bugs will be fixed in patch releases
- Documentation: Documentation is being improved continuously
- Security: Formal security audit planned before v1.0.0
- Bugs: GitHub Issues
- Security Vulnerabilities: See SECURITY.md
- Questions: GitHub Discussions
For more details, see RELEASE.md.
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Security: security@quantsec.io
- NIST Post-Quantum Cryptography Standardization
- Open Quantum Safe project
- Rust cryptography community
QuantSec SDK - Hybrid quantum-resistant security for today's applications.