Quantum-Safe Cryptography for TypeScript

A unified, modular monorepo suite providing 50+ classical, modern, and post-quantum cryptographic primitives, high-performance WebAssembly acceleration, REST microservice, and full-stack integrations.

100% Test Coverage Floor FIPS 203 / 204 / 205 / 206 RFC 10024 Hybrid KEMs Zero Unsafe Dependencies Node.js >= 22 LTS Apache-2.0 OR MIT

Workspace Packages (14 Modules)

Each package maintains zero cyclic dependencies, 100% branch and statement coverage, and full TypeDoc documentation.

Core modern cryptographic engine: ML-KEM, ML-DSA, SLH-DSA, FN-DSA, RFC 10024 hybrid KEMs, AES-GCM-SIV, HPKE, PASETO v4, Double Ratchet, PAKE, and memory zeroing.

High-level formatting, validation, and documentation generation utilities providing standardized schemas and JSON-RPC / REST models.

Production-ready command-line interface: key generation, hashing, encryption, signing, password verification, and shell automation.

Fastify-based REST microservice exposing 34+ cryptographic endpoints, OpenAPI / Swagger schemas, rate limiting, and RBAC.

Universal client SDK for browsers and Node.js with built-in retry policies, error handling, and type-safe server bindings.

Zero-dependency Edge runtime adapters optimized for Cloudflare Workers, Vercel Edge, Deno, and WinterCG runtimes.

Unified Key Management Service provider integrating AWS KMS, GCP Cloud KMS, Azure Key Vault, and HashiCorp Vault.

High-performance WebAssembly acceleration modules compiled from Rust for compute-intensive post-quantum operations.

Transparent field-level encryption middleware for Prisma Client supporting blind indexing and envelope encryption.

TypeORM column transformers and entity subscriber decorators for automated database encryption at rest.

Framework-agnostic HTTP middleware providing request payload decryption, response encryption, and signature validation.

React hooks library providing useEncrypt, useHash, useKeypair, and useSignature for frontend applications.

Vue 3 composables library offering reactive cryptographic state and asynchronous execution bridges.

Comprehensive test harness, synthetic cryptographic vectors, mock KMS providers, and compliance validation suites.

Cryptographic Standard Specifications

Adherence to NIST FIPS, IETF RFC, and standard specifications implemented across the monorepo suite.

Specification Algorithm Name / Category Parameter Sets / Ciphers Primary Module
FIPS 203 ML-KEM (Module-Lattice KEM) ML-KEM-512, ML-KEM-768, ML-KEM-1024 crypto-lib/modern/pq-kem
FIPS 204 ML-DSA (Module-Lattice Signatures) ML-DSA-44, ML-DSA-65, ML-DSA-87 crypto-lib/modern/pq-sign
FIPS 205 SLH-DSA (Stateless Hash Signatures) SLH-DSA-SHA2-128s, SLH-DSA-SHAKE-256f crypto-lib/modern/pq-hash-sign
FIPS 206 FN-DSA (FALCON Signatures) FALCON-512, FALCON-1024 crypto-lib/modern/fn-dsa
RFC 10024 Hybrid Post-Quantum KEMs X25519MLKEM768 (0x11ec), SecP256r1MLKEM768 (0x11ed) crypto-lib/modern/pq-kem
RFC 9180 HPKE (Hybrid Public Key Encryption) DHKEM(X25519) + HKDF-SHA256 + ChaCha20Poly1305 crypto-lib/modern/hpke
RFC 8439 ChaCha20-Poly1305 & XChaCha20 Authenticated Encryption with Associated Data (AEAD) crypto-lib/modern/aead
NIST SP 800-38D AES-GCM & AES-GCM-SIV Misuse-resistant authenticated encryption crypto-lib/modern/aes
PASETO v4 Platform-Agnostic Security Tokens v4.local (XChaCha20-Poly1305), v4.public (Ed25519) crypto-lib/tokens/paseto
Threshold Cryptography Shamir Secret Sharing + Feldman VSS (k, n) threshold key generation and distributed Ed25519 signing crypto-lib/protocols/threshold

Quick Start Code Examples

Minimal runnable samples demonstrating classical and post-quantum cryptographic operations.

// 1. Import ML-KEM and RFC 10024 hybrid KEM from crypto-lib import { mlKemKeygen, mlKemEncapsulate, mlKemDecapsulate, hybridKemKeygen, hybridKemEncapsulate, hybridKemDecapsulate, RFC10024_X25519_MLKEM768, wipeMemory } from "@sebastienrousseau/crypto-lib"; // 2. Post-Quantum Key Exchange: FIPS 203 ML-KEM-768 const alice = mlKemKeygen(768); const { ciphertext, sharedSecret: bobSecret } = mlKemEncapsulate(768, alice.publicKey); const { sharedSecret: aliceSecret } = mlKemDecapsulate(768, alice.secretKey, ciphertext); console.log("Shared secrets match:", aliceSecret === bobSecret); // 3. RFC 10024 Classical + PQ Hybrid Key Exchange (X25519 + ML-KEM-768) const recipient = hybridKemKeygen(768); const senderResult = hybridKemEncapsulate(768, recipient.x25519PublicKey, recipient.mlKemPublicKey); const recipientResult = hybridKemDecapsulate( 768, recipient.x25519PrivateKey, recipient.mlKemSecretKey, senderResult.x25519EphemeralPublic, senderResult.mlKemCiphertext ); console.log("Hybrid secret derived:", recipientResult.sharedSecret === senderResult.sharedSecret); // 4. Memory Zeroing to sanitize sensitive key buffers const keyBuf = new Uint8Array([0xde, 0xad, 0xbe, 0xef]); wipeMemory(keyBuf); console.log("Buffer wiped:", keyBuf.every(b => b === 0)); // true