pqc

package module
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 5, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

README

Post-Quantum Cryptography Toolkit

Editorial image of a secure operations environment with post-quantum cryptography infrastructure

pqc lets you:

  • Manage post-quantum cryptography keys.
  • Encrypt data with ML-KEM envelopes.
  • Sign artifacts with ML-DSA.
  • Inspect TLS endpoints for hybrid post-quantum cryptography.
  • Score migration readiness.
  • Produce signed audit and transparency evidence.
  • Run local or remote key operations through pqcd.
  • Experiment with post-quantum cryptography certificate and signature profiles.

Use it to turn a post-quantum cryptography migration plan into working systems: generate keys, rotate versions, protect data, inspect real endpoints, and preserve repeatable evidence for engineering, vendor, and compliance reviews.

Install

go install github.com/helsingin/pqc/cmd/pqc@latest
go install github.com/helsingin/pqc/cmd/pqcd@latest

From a local checkout:

make build

Manage Keys

pqc keys create --type ml-kem-768 --id service-a
pqc keys create --type ml-dsa-65 --id signer-a
pqc keys rotate --id service-a
pqc keys list
pqc keys public --id signer-a

Encrypt Data

pqc encrypt --key service-a < message.json > message.pqc
pqc decrypt < message.pqc > message.out

Sign Artifacts

pqc sign --key signer-a artifact.tar > artifact.sig
pqc verify --key signer-a artifact.tar artifact.sig

Inspect TLS

pqc tls inspect example.com:443
pqc tls readiness example.com:443

Score Readiness

pqc inventory scan --store ./dev-keys --target example.com:443
pqc readiness scan --store ./dev-keys --target example.com:443

Produce Evidence

pqc keys create --type ml-dsa-65 --id audit-signer --audit-log ./audit.jsonl
pqc audit checkpoint --audit ./audit.jsonl --sign-key audit-signer
pqc transparency checkpoint --sign-key audit-signer --target example.com:443

Run A Key Service

pqcd --addr 127.0.0.1:8080 --token "$PQC_API_TOKEN"
pqc keys list --remote http://127.0.0.1:8080 --token "$PQC_API_TOKEN"

Experiment With Certificate And Signature Profiles

pqc profiles list
pqc profiles show x509-ml-dsa
pqc issue --profile mtc --sign-key signer-a --subject example.com --dns example.com
pqc verify-artifact artifact.json

Documentation

Notes

  • Current post-quantum cryptography primitives: ML-KEM-768, ML-DSA-65, and ML-DSA-87.
  • The implementation uses Cloudflare CIRCL for post-quantum cryptography primitives and the Go standard library for HKDF and AES-GCM.
  • Treat this as a migration and integration toolkit, not a replacement for hardened production key custody, access control, or incident response design.

License

Apache-2.0. See LICENSE.

Documentation

Index

Constants

View Source 
const (
	AlgorithmMLKEM768 = core.AlgorithmMLKEM768
	AlgorithmMLDSA65  = core.AlgorithmMLDSA65
	AlgorithmMLDSA87  = core.AlgorithmMLDSA87

	KeyUseKEM       = core.KeyUseKEM
	KeyUseSignature = core.KeyUseSignature

	EnvelopeSchema  = core.EnvelopeSchema
	SignatureSchema = core.SignatureSchema
	KDFHKDFSHA256   = core.KDFHKDFSHA256
	AEADAES256GCM   = core.AEADAES256GCM

	MerkleHashSHA256             = core.MerkleHashSHA256
	AuditCheckpointSchema        = core.AuditCheckpointSchema
	InventoryReportSchema        = core.InventoryReportSchema
	TransparencyCheckpointSchema = core.TransparencyCheckpointSchema
	TransparencyBundleSchema     = core.TransparencyBundleSchema

	MTCLogSchema           = core.MTCLogSchema
	MTCCheckpointSchema    = core.MTCCheckpointSchema
	MTCProofSchema         = core.MTCProofSchema
	MTCTreeheadCacheSchema = core.MTCTreeheadCacheSchema

	ReadinessScanSchema = core.ReadinessScanSchema

	RevocationManifestSchema = core.RevocationManifestSchema

	TLSVerificationSystem           = core.TLSVerificationSystem
	TLSVerificationCustom           = core.TLSVerificationCustom
	TLSVerificationSkipped          = core.TLSVerificationSkipped
	TLSReadinessPolicyPublicWeb2029 = core.TLSReadinessPolicyPublicWeb2029
)

Variables

View Source 
var (
	ErrKeyNotFound      = core.ErrKeyNotFound
	ErrKeyExists        = core.ErrKeyExists
	ErrInvalidEnvelope  = core.ErrInvalidEnvelope
	ErrInvalidSignature = core.ErrInvalidSignature
)

Functions

func ApplyTLSReadinessPolicy 

func ApplyTLSReadinessPolicy(report *InventoryReport, policyID string, now time.Time) error

func DefaultMTCTreeheadLogID 

func DefaultMTCTreeheadLogID(source string) string

func MTCLeafHash 

func MTCLeafHash(entry MTCLogEntry) (string, error)

func MTCTreeheadEntryID 

func MTCTreeheadEntryID(entry MTCTreeheadEntry) (string, error)

func MerkleRootHex 

func MerkleRootHex(leaves [][]byte) string

func ParseRevocationSubject 

func ParseRevocationSubject(subjectType, subject string) (string, string, error)

func PublicKeyFingerprint 

func PublicKeyFingerprint(publicKey []byte) string

func RevocationEventID 

func RevocationEventID(event RevocationEvent) (string, error)

func RevocationManifestDigest 

func RevocationManifestDigest(manifest RevocationManifest) (string, error)

func RevocationManifestRoot 

func RevocationManifestRoot(manifest RevocationManifest) (string, error)

func SignAuditCheckpoint 

func SignAuditCheckpoint(ctx context.Context, manager interface {
	Sign(context.Context, string, []byte, SignOptions) (*SignatureEnvelope, error)
}, checkpoint *AuditCheckpoint, signKey string) error

func SignMTCCheckpoint 

func SignMTCCheckpoint(ctx context.Context, manager interface {
	Sign(context.Context, string, []byte, SignOptions) (*SignatureEnvelope, error)
}, checkpoint *MTCCheckpoint, signKey string) error

func SignTransparencyCheckpoint 

func SignTransparencyCheckpoint(ctx context.Context, manager interface {
	Sign(context.Context, string, []byte, SignOptions) (*SignatureEnvelope, error)
}, checkpoint *TransparencyCheckpoint, signKey string) error

func ValidateRevocationManifest 

func ValidateRevocationManifest(manifest RevocationManifest) error

func VerifyAuditCheckpoint 

func VerifyAuditCheckpoint(r io.Reader, checkpoint *AuditCheckpoint, publicKey *PublicKey) error

func VerifyMTCProof 

func VerifyMTCProof(proof *MTCProof, checkpoint *MTCCheckpoint, publicKey *PublicKey) error

func VerifyTransparencyBundle 

func VerifyTransparencyBundle(bundle TransparencyBundle, publicKey *PublicKey) error

func VerifyTransparencyCheckpoint 

func VerifyTransparencyCheckpoint(report InventoryReport, checkpoint *TransparencyCheckpoint, publicKey *PublicKey) error

func VerifyTransparencyCheckpointWithRevocations 

func VerifyTransparencyCheckpointWithRevocations(report InventoryReport, revocations *RevocationManifest, checkpoint *TransparencyCheckpoint, publicKey *PublicKey) error

func VerifyWithPublicKey 

func VerifyWithPublicKey(publicKey PublicKey, message []byte, sig *SignatureEnvelope) error

func WriteRevocationManifest 

func WriteRevocationManifest(w io.Writer, manifest RevocationManifest) error

Types

type Algorithm 

type Algorithm = core.Algorithm

func ParseAlgorithm 

func ParseAlgorithm(value string) (Algorithm, error)

type AuditCheckpoint 

type AuditCheckpoint = core.AuditCheckpoint

func BuildAuditCheckpoint 

func BuildAuditCheckpoint(r io.Reader, now time.Time) (*AuditCheckpoint, error)

type AuditEvent 

type AuditEvent = core.AuditEvent

type Auditor 

type Auditor = core.Auditor

type AuditorFunc 

type AuditorFunc = core.AuditorFunc

type EncryptOptions 

type EncryptOptions = core.EncryptOptions

type Envelope 

type Envelope = core.Envelope

type FileAuditor 

type FileAuditor = core.FileAuditor

func NewFileAuditor 

func NewFileAuditor(path string) (*FileAuditor, error)

type GenerateRequest 

type GenerateRequest = core.GenerateRequest

type InventoryEntry 

type InventoryEntry = core.InventoryEntry

type InventoryReport 

type InventoryReport = core.InventoryReport

func BuildInventoryReport 

func BuildInventoryReport(keys []KeyMetadata, targets []TLSReport, now time.Time) InventoryReport

type KeyMetadata 

type KeyMetadata = core.KeyMetadata

type KeyRecord 

type KeyRecord = core.KeyRecord

type KeyUse 

type KeyUse = core.KeyUse

type MTCCheckpoint 

type MTCCheckpoint = core.MTCCheckpoint

func BuildMTCCheckpoint 

func BuildMTCCheckpoint(log MTCLog, now time.Time) (*MTCCheckpoint, error)

type MTCLog 

type MTCLog = core.MTCLog

func NewMTCLog 

func NewMTCLog(now time.Time) MTCLog

type MTCLogEntry 

type MTCLogEntry = core.MTCLogEntry

type MTCProof 

type MTCProof = core.MTCProof

func BuildMTCProof 

func BuildMTCProof(log MTCLog, leafIndex int, now time.Time) (*MTCProof, error)

type MTCProofNode 

type MTCProofNode = core.MTCProofNode

type MTCTreeheadCache 

type MTCTreeheadCache = core.MTCTreeheadCache

func NewMTCTreeheadCache 

func NewMTCTreeheadCache(source string, entries []MTCTreeheadEntry, now time.Time) MTCTreeheadCache

func ParseMTCTreeheadSource 

func ParseMTCTreeheadSource(data []byte, source string, publicKey *PublicKey, logID string, now time.Time) (MTCTreeheadCache, error)

type MTCTreeheadEntry 

type MTCTreeheadEntry = core.MTCTreeheadEntry

func NewMTCTreeheadEntry 

func NewMTCTreeheadEntry(source, logID string, checkpoint MTCCheckpoint, publicKey PublicKey, now time.Time) (MTCTreeheadEntry, error)

type MTCTreeheadFinding 

type MTCTreeheadFinding = core.MTCTreeheadFinding

type MTCTreeheadVerifyResult 

type MTCTreeheadVerifyResult = core.MTCTreeheadVerifyResult

func VerifyMTCTreeheadCache 

func VerifyMTCTreeheadCache(cache MTCTreeheadCache) (*MTCTreeheadVerifyResult, error)

type Manager 

type Manager = core.Manager

func NewManager 

func NewManager(store Store, opts ...Option) *Manager

type Option 

type Option = core.Option

func WithAuditor 

func WithAuditor(auditor Auditor) Option

func WithClock 

func WithClock(now func() time.Time) Option

func WithRand 

func WithRand(randReader io.Reader) Option

type PublicKey 

type PublicKey = core.PublicKey

type ReadinessCategory 

type ReadinessCategory = core.ReadinessCategory

type ReadinessCoverage 

type ReadinessCoverage = core.ReadinessCoverage

type ReadinessFinding 

type ReadinessFinding = core.ReadinessFinding

type ReadinessScan 

type ReadinessScan = core.ReadinessScan

func BuildReadinessScan 

func BuildReadinessScan(report InventoryReport, now time.Time) ReadinessScan

type RevocationEvent 

type RevocationEvent = core.RevocationEvent

type RevocationManifest 

type RevocationManifest = core.RevocationManifest

func NewRevocationManifest 

func NewRevocationManifest(now time.Time) RevocationManifest

func ReadRevocationManifest 

func ReadRevocationManifest(r io.Reader) (RevocationManifest, error)

type SignOptions 

type SignOptions = core.SignOptions

type SignatureEnvelope 

type SignatureEnvelope = core.SignatureEnvelope

type Store 

type Store = core.Store

type TLSCertificate 

type TLSCertificate = core.TLSCertificate

type TLSInspectOptions 

type TLSInspectOptions = core.TLSInspectOptions

type TLSReadiness 

type TLSReadiness = core.TLSReadiness

func EvaluateTLSReadiness 

func EvaluateTLSReadiness(report TLSReport, policy TLSReadinessPolicy, now time.Time) TLSReadiness

type TLSReadinessPolicy 

type TLSReadinessPolicy = core.TLSReadinessPolicy

func PublicWeb2029TLSReadinessPolicy 

func PublicWeb2029TLSReadinessPolicy() TLSReadinessPolicy

func ResolveTLSReadinessPolicy 

func ResolveTLSReadinessPolicy(id string) (TLSReadinessPolicy, error)

type TLSReport 

type TLSReport = core.TLSReport

func InspectTLS 

func InspectTLS(ctx context.Context, target string, opts TLSInspectOptions) (TLSReport, error)

type TransparencyBundle 

type TransparencyBundle = core.TransparencyBundle

func BuildTransparencyBundle 

func BuildTransparencyBundle(report InventoryReport, checkpoint *TransparencyCheckpoint) (TransparencyBundle, error)

func BuildTransparencyBundleWithRevocations 

func BuildTransparencyBundleWithRevocations(report InventoryReport, revocations *RevocationManifest, checkpoint *TransparencyCheckpoint) (TransparencyBundle, error)

type TransparencyCheckpoint 

type TransparencyCheckpoint = core.TransparencyCheckpoint

func BuildTransparencyCheckpoint 

func BuildTransparencyCheckpoint(report InventoryReport, now time.Time) (*TransparencyCheckpoint, error)

func BuildTransparencyCheckpointWithRevocations 

func BuildTransparencyCheckpointWithRevocations(report InventoryReport, revocations *RevocationManifest, now time.Time) (*TransparencyCheckpoint, error)

Source Files

View all Source files

Directories

Path Synopsis
cmd
pqc command
pqcd command
internal
core
Package profile defines artifact profile plugins for PQC certificate, signature, and TLS authentication artifact families.
 Package profile defines artifact profile plugins for PQC certificate, signature, and TLS authentication artifact families.
profiles
all
compositex509
fndsa
mtc
x509mldsa
store
agefile
file

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.