GitHub โ†—

PQGuard

๐Ÿงช View test results โ†’

Post-quantum file encryption CLI โ€” ML-KEM-768 (FIPS 203) + AES-256-GCM.

Encrypt files using NIST-standardized post-quantum algorithms that resist both classical and quantum computer attacks.

Project status: production-quality Rust cryptography, NIST FIPS 203 compliant, fuzz-tested, published on crates.io.

๐ŸŽฏ What it does

Capability Description
Post-quantum key exchange ML-KEM-768 (Kyber768) โ€” NIST Level 3, resists Shor's algorithm
Hybrid encryption KEM + HKDF-SHA256 + AES-256-GCM โ€” industry-standard symmetric layer
CLI interface keygen, encrypt, decrypt, verify, info commands
Key management Named keypairs with public/private separation
File verification Integrity check without decryption
NIST compliance FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)

โš™๏ธ Architecture

โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
โ”‚  ENCRYPTION                                         โ”‚
โ”‚                                                     โ”‚
โ”‚  1. Generate random salt + nonce                    โ”‚
โ”‚  2. ML-KEM-768 encapsulate โ†’ shared secret + ct     โ”‚
โ”‚  3. HKDF-SHA256(shared_secret, salt) โ†’ aes_key     โ”‚
โ”‚  4. AES-256-GCM(aes_key, nonce, plaintext) โ†’ ct    โ”‚
โ”‚  5. Write: PQGR โ€– version โ€– kem_ct โ€– nonce โ€–      โ”‚
โ”‚            salt โ€– aes_ct                            โ”‚
โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜

โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
โ”‚  DECRYPTION                                         โ”‚
โ”‚                                                     โ”‚
โ”‚  1. Parse PQGR envelope                             โ”‚
โ”‚  2. ML-KEM-768 decapsulate(ct, dk) โ†’ shared_secret  โ”‚
โ”‚  3. HKDF-SHA256(shared_secret, salt) โ†’ aes_key     โ”‚
โ”‚  4. AES-256-GCM decrypt(aes_key, nonce, aes_ct)     โ”‚
โ”‚  5. Output plaintext                                โ”‚
โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜

๐Ÿš€ Quick start

# Install
cargo install pqguard

# Generate keypair
pqguard keygen

# Encrypt a file
pqguard encrypt secret.txt --recipient public_key.pqg.pub

# Multi-recipient โ€” any listed private key can decrypt
pqguard encrypt secret.txt -r alice.pqg.pub -r bob.pqg.pub

# Decrypt
pqguard decrypt secret.pqg --private-key private_key.pqg.key

๐Ÿ“– Commands

Command Description
pqguard keygen Generate ML-KEM-768 keypair
pqguard encrypt <file> -r <pubkey> Encrypt file for one recipient
pqguard encrypt <file> -r <a> -r <b> Multi-recipient (v2 envelope)
pqguard decrypt <file> -k <privkey> Decrypt file with private key
pqguard verify <file> Verify pqguard file integrity
pqguard info <keyfile> Show key information

๐Ÿ” Algorithm Details

Component Algorithm Standard
Key Exchange ML-KEM-768 (Kyber768) NIST FIPS 203
Key Derivation HKDF-SHA256 RFC 5869
Symmetric Encryption AES-256-GCM NIST SP 800-38D

๐Ÿ“Š Benchmarks

Operation Time
Keygen ~150ฮผs
Encapsulate ~25ฮผs
Decapsulate ~30ฮผs
AES-256-GCM (1MB) ~0.5ms

๐Ÿงช Why Post-Quantum?

Classical cryptography (RSA, ECDH) will be broken by quantum computers running Shor's algorithm. NIST finalized post-quantum standards in 2024:

  • ML-KEM (FIPS 203) โ€” Key encapsulation
  • ML-DSA (FIPS 204) โ€” Digital signatures
  • SLH-DSA (FIPS 205) โ€” Hash-based signatures

The "harvest now, decrypt later" threat means data encrypted today with classical algorithms can be decrypted by future quantum computers. pqguard protects against this.

๐Ÿ”— Links