quantum-shield: Production-Ready Post-Quantum Cryptography

The quantum computing threat to current cryptography is real and approaching. Red Asgard is releasing quantum-shield, a Rust library implementing NIST-standardized post-quantum algorithms for hybrid cryptographic systems.

Package: quantum-shield on crates.io
Repository: github.com/redasgard/quantum-shield
License: MIT
Version: 0.1.0
Downloads: 172+

---

The Quantum Threat

Current Risk Timeline

2025-2030: Large-scale quantum computers capable of breaking RSA-2048 and ECC-256
Today: "Harvest now, decrypt later" attacks are already happening
NIST Response: Standardized post-quantum algorithms in 2024

Vulnerable Today:

• RSA (all key sizes)
• Elliptic Curve Cryptography (ECDSA, ECDH)
• Diffie-Hellman key exchange
• Most current TLS/SSL

Safe from Quantum:

• Lattice-based cryptography (Kyber, Dilithium)
• Hash-based signatures
• Code-based cryptography

---

NIST-Standardized Algorithms

Kyber (Key Encapsulation)

Use Case: Encryption and key exchange
Security: Based on Module-LWE (lattice problem)
Performance: 10-100x faster than RSA
Standardized: NIST FIPS 203

use quantum_shield::kyber::{Keypair, PublicKey};

// Key generation
let keypair = Keypair::generate();

// Encapsulation (sender)
let (ciphertext, shared_secret) = keypair.public_key().encapsulate();

// Decapsulation (receiver)
let decrypted_secret = keypair.secret_key().decapsulate(&ciphertext)?;

assert_eq!(shared_secret, decrypted_secret);

Dilithium (Digital Signatures)

Use Case: Authentication and signing
Security: Based on Module-LIS (lattice problem)
Performance: Competitive with ECDSA
Standardized: NIST FIPS 204

use quantum_shield::dilithium::{Keypair, Signature};

// Key generation
let keypair = Keypair::generate();

// Sign message
let message = b"Important document";
let signature = keypair.sign(message);

// Verify signature
assert!(keypair.public_key().verify(message, &signature));

---

Hybrid Cryptography Mode

Best Practice: Use post-quantum algorithms alongside classical crypto for defense-in-depth:

use quantum_shield::hybrid::{HybridKeypair, HybridCipher};

// Combines Kyber (PQ) + X25519 (classical)
let keypair = HybridKeypair::generate();

// Encryption provides security even if one algorithm breaks
let ciphertext = keypair.public_key().encrypt(plaintext)?;
let decrypted = keypair.secret_key().decrypt(&ciphertext)?;

assert_eq!(plaintext, decrypted);

Security Guarantee: Ciphertext remains secure as long as either Kyber or X25519 is unbroken.

---

Production Features

1. No-std Support

#![no_std]

use quantum_shield::kyber::Keypair;

// Works in embedded systems, WASM, bare metal
let keypair = Keypair::generate();

2. Async Support

use quantum_shield::async_api::*;

async fn secure_communication() {
    let keypair = Keypair::generate_async().await;
    
    let (ciphertext, secret) = keypair
        .public_key()
        .encapsulate_async()
        .await;
}

3. Serialization

use quantum_shield::kyber::Keypair;

// Serialize for storage/transmission
let keypair = Keypair::generate();
let public_key_bytes = keypair.public_key().to_bytes();
let secret_key_bytes = keypair.secret_key().to_bytes();

// Deserialize
let public_key = PublicKey::from_bytes(&public_key_bytes)?;
let secret_key = SecretKey::from_bytes(&secret_key_bytes)?;

---

Real-World Applications

Secure Communication

use quantum_shield::hybrid::HybridCipher;

struct SecureChannel {
    cipher: HybridCipher,
}

impl SecureChannel {
    fn new() -> Self {
        Self {
            cipher: HybridCipher::new()
        }
    }
    
    fn encrypt_message(&self, message: &[u8]) -> Vec<u8> {
        self.cipher.encrypt(message).expect("Encryption failed")
    }
    
    fn decrypt_message(&self, ciphertext: &[u8]) -> Vec<u8> {
        self.cipher.decrypt(ciphertext).expect("Decryption failed")
    }
}

Document Signing

use quantum_shield::dilithium::Keypair;

fn sign_document(document: &[u8], keypair: &Keypair) -> Signature {
    keypair.sign(document)
}

fn verify_document(
    document: &[u8],
    signature: &Signature,
    public_key: &PublicKey
) -> bool {
    public_key.verify(document, signature)
}

TLS Integration (Future)

// Planned for v0.2.0
use quantum_shield::tls::HybridTlsConfig;

let config = HybridTlsConfig::builder()
    .with_kyber_kem()
    .with_dilithium_signatures()
    .with_classical_fallback()
    .build();

let tls_server = TlsServer::new(config);

---

Performance Benchmarks

Measured on AMD Ryzen 9 5950X:

Kyber-768 (Recommended Security Level)

Operation	Time
Key generation	0.05ms
Encapsulation	0.06ms
Decapsulation	0.07ms
Total roundtrip	0.18ms

Dilithium-3 (Recommended Security Level)

Operation	Time
Key generation	0.18ms
Signing	0.32ms
Verification	0.11ms
Total sign+verify	0.43ms

Comparison with Classical:

• RSA-2048: Key gen 50ms, Sign 0.5ms, Verify 0.05ms
• ECDSA-256: Key gen 0.1ms, Sign 0.08ms, Verify 0.12ms

Quantum-shield is competitive or faster than RSA while being quantum-resistant!

---

Security Levels

Three security levels available for different use cases:

use quantum_shield::{SecurityLevel, Kyber, Dilithium};

// Security Level 1 (AES-128 equivalent)
let kyber_512 = Kyber::new(SecurityLevel::Level1);
let dilithium_2 = Dilithium::new(SecurityLevel::Level1);

// Security Level 3 (AES-192 equivalent) - RECOMMENDED
let kyber_768 = Kyber::new(SecurityLevel::Level3);
let dilithium_3 = Dilithium::new(SecurityLevel::Level3);

// Security Level 5 (AES-256 equivalent)
let kyber_1024 = Kyber::new(SecurityLevel::Level5);
let dilithium_5 = Dilithium::new(SecurityLevel::Level5);

Recommendation: Use Level 3 for most applications (good security/performance balance).

---

Migration Guide

From RSA

// Before (RSA)
use rsa::{RsaPrivateKey, RsaPublicKey};

let private_key = RsaPrivateKey::new(&mut rng, 2048)?;
let public_key = RsaPublicKey::from(&private_key);

// After (Hybrid: Dilithium + RSA)
use quantum_shield::hybrid::HybridSigningKey;

let hybrid_key = HybridSigningKey::generate(); // PQ + RSA
let signature = hybrid_key.sign(message);

From ECDSA

// Before (ECDSA)
use k256::ecdsa::{SigningKey, VerifyingKey};

let signing_key = SigningKey::random(&mut rng);
let verifying_key = VerifyingKey::from(&signing_key);

// After (Hybrid: Dilithium + ECDSA)
use quantum_shield::hybrid::HybridSigningKey;

let hybrid_key = HybridSigningKey::with_ecdsa_fallback();

---

Cryptographic Details

Kyber Security Basis

Hard Problem: Module Learning With Errors (Module-LWE)
Best Known Attack: Lattice reduction (exponential time)
Quantum Attack: Still exponential (unlike RSA/ECC)

Parameters (Kyber-768):

• Public key: 1,184 bytes
• Secret key: 2,400 bytes
• Ciphertext: 1,088 bytes
• Shared secret: 32 bytes

Dilithium Security Basis

Hard Problem: Module Short Integer Solution (Module-SIS)
Best Known Attack: Lattice reduction
Quantum Attack: Still exponential

Parameters (Dilithium-3):

• Public key: 1,952 bytes
• Secret key: 4,000 bytes
• Signature: 3,293 bytes

---

Standards Compliance

NIST Standards:

• ? FIPS 203 (Kyber/ML-KEM)
• ? FIPS 204 (Dilithium/ML-DSA)
• ? SP 800-186 (PQC recommendations)

Interoperability:

• Compatible with other NIST PQC implementations
• Standard key formats
• Cross-language support

---

When to Use Post-Quantum Crypto

Use Now:

• Long-term encrypted data (>10 year lifetime)
• Critical infrastructure
• Financial systems
• Government/military applications
• Blockchain/cryptocurrency

Migrate Soon:

• TLS/HTTPS certificates
• Code signing
• Document signing
• VPN connections
• Secure messaging

Can Wait:

• Ephemeral data (short lifetime)
• Low-value targets
• Already deprecated systems

---

Installation

[dependencies]
quantum-shield = "0.1"

# Features
quantum-shield = { version = "0.1", features = ["async", "std"] }

# No-std for embedded
quantum-shield = { version = "0.1", default-features = false }

---

Roadmap

v0.2.0:

• SPHINCS+ (hash-based signatures)
• Classic McEliece (code-based encryption)
• TLS 1.3 integration
• Hardware acceleration

v0.3.0:

• HSM integration
• Key derivation functions
• Certificate generation
• PKI utilities

---

Get Involved

cargo add quantum-shield

Need help?

• GitHub Issues
• Enterprise support: [email protected]

---

Released: October 24, 2025
Algorithms: Kyber (FIPS 203), Dilithium (FIPS 204)
Quantum-safe: Yes