Applied Post-Quantum Cryptography
Where post-quantum cryptography actually stands: what has shipped, what is still a draft, and what breaks when you deploy it. Byte-exact implementations of all four standards, and the book that derives them.
Everything in the project
What to deploy and what it costs, the standards themselves, the code that implements them, and the research behind it. Filter by what you need.
-
What has shipped
A curated, link-verified list of what is actually available to build against: the standards, the test vectors, the libraries that implement them, and the deployment and migration guidance.
-
The book
The full arc, from finite fields and lattices through all four standards, then the deployment questions: hybrid TLS, side channels, blockchain exposure, and what migration costs in blockspace.
-
Runnable code
All 108 code listings and the four reference implementations run in your browser, with nothing to install.
-
bitcoin-stark-verifier
A STARK verifier in Bitcoin Script with no
OP_CAT: Poseidon2 over KoalaBear, and WHIR on top of it. Every challenge is squeezed inside the script and every constraint derived from the transcript, so the verifier ends on its own identity rather than on a hint. -
Disproving one step
The verifier is three hundred blocks and is never run on chain. What is run is one chunk of it, bound by Winternitz signatures: 22 Poseidon2 rounds in a standard transaction, about two thousand chunks for the whole verifier.
-
WHIR on Bitcoin Script
A formal account of the STIR and WHIR proximity tests, and a review of the verifier against them: the algorithm stated formally, the implementation reviewed against it, and completeness and soundness separated into what the protocol proves and what the script checks.
-
ML-KEM
21 of 21 algorithms. Key encapsulation at 512, 768 and 1024.
-
ML-DSA
49 of 49 algorithms. Signatures at 44, 65 and 87.
-
SLH-DSA
25 of 25 algorithms, all twelve approved parameter sets.
-
FN-DSA
18 of 18 Falcon algorithms. Still in development at NIST, so validated against Falcon's own tests.
-
The construction of SHRINCS, a semi-stateful hash-based signature scheme
SHRINCS demotes SLH-DSA to a fallback path and puts a 548-byte stateful signature on the primary one. What the draft reuses from FIPS 205, what it only reparameterises, what it constructs anew, and what it gives up.
-
Post-quantum migration for Bitcoin layer 2s
A Bitcoin layer 2 settles to a base layer it cannot change, borrows consensus from a third ecosystem, and runs a bridge whose trust root is cryptography of its own choosing. Where the post-quantum exposure actually sits, and who can fix each part.
Nothing matches that.
The implementations on GitHub → · 462 checks, 0 failures against ACVP · all posts →