quantakrypto
Loading…
Loading…
Every article tagged ML-DSA, newest first.
6 articles
We reviewed the most widely used pure-JavaScript post-quantum library twice, six days apart, and found eighteen defects. Not one of them is in the maths. The first round was merged in two hours; the second found twelve more in the repaired code; then the maintainer read our patches and found two defects in them.
The most serious finding in our review of the Dart Nostr Development Kit was not cryptographic. It was a GPL-3.0-only crate inside an MIT-licensed SDK. Compiled into every application that depended on the SDK, whether or not that application used post-quantum code at all. All five findings are now fixed and shipped in ndk 0.9.0.
Every encrypted Nostr message published today is a future plaintext. We are proposing a NIP, jointly with nostr-wot, that lets an identity derive post-quantum keys from its seed phrase where it has a 24-word one - so those words still restore the identity after the transition. Accounts without one, which is most of them, generate an independent key that needs its own backup. It is implemented and running against public relays, not a design document: you can send a post-quantum encrypted message and take it apart layer by layer.
Cloudflare now supports post-quantum authentication between its edge and your origin server: Authenticated Origin Pulls and Custom Origin Trust Store both accept ML-DSA (FIPS 204) certificates. Paired with the X25519MLKEM768 key exchange already running on that hop, this is the first mainstream path to a fully post-quantum CDN-to-origin connection, not just the browser-to-edge leg.
Go 1.27, released this month, adds a crypto/mldsa package implementing ML-DSA (FIPS 204), plus ML-DSA support in crypto/x509 and crypto/tls. Post-quantum signatures are no longer a third-party dependency for Go services, they are a standard-library import. Here is what shipped and what it means for the migration.
Even a correct-looking post-quantum implementation can fail in the specific bug-class patterns we see repeatedly in audits. Sieve encodes those classes as targeted, reusable test batteries.
Book a discovery call and get an indicative scope and pricing for your organisation.