Playground
Every algorithm in Applied Post-Quantum Cryptography has a SageMath implementation, and the cells below run them in your browser — no install, nothing to download. Edit any cell and press Run.
The code is not copied into this page. Each cell fetches the
.sage sources straight from the
repository, so what runs here is exactly the code the book
documents.
Execution happens on the free SageMath Cell service, which allows 30 seconds per run. Nearly everything fits; the few operations that do not are noted below, with the command to run them locally.
The four standards are below. Every other listing in the book — the lattice, LWE, NTT and toy-Kyber experiments the chapters build up from — is runnable too, chapter by chapter, at the end of this page.
ML-KEM (FIPS 203)
Key generation, encapsulation and decapsulation at all three parameter sets. The encapsulation and decapsulation keys agree on the shared secret, and the sizes are the ones in FIPS 203 Table 3.
The number-theoretic transform is a ring isomorphism, not merely a fast multiplication trick. This check confirms all three parts of that claim using Sage's own arithmetic as the oracle — it is the check discussed in the ML-KEM chapter.
ML-DSA (FIPS 204)
Signing uses Fiat–Shamir with aborts, so the number of rejection-loop iterations varies from run to run. Public key and signature sizes match FIPS 204 Table 2.
SLH-DSA (FIPS 205)
The f ("fast") parameter sets sign quickly enough to run
here end to end.
The s ("small") sets trade signing time for signature
size, and signing them takes far longer than 30 seconds. Verification,
though, is the fast direction — well under a second — so
apqc_demo_sig supplies a signature from NIST's ACVP vectors
and the verifier does the rest. Note how much smaller these are than the
f signature above.
FN-DSA (FIPS 206, Falcon)
FIPS 206 is still in development, so this follows the round-3 Falcon submission. Two checks run in well under a second: the Gaussian sampler against Falcon's published test vectors, and the floating-point FFT against exact arithmetic in the polynomial ring.
Falcon key generation runs the NTRU tower solver, which needs minutes
rather than seconds, so apqc_demo_key loads the round-3 KAT
key instead. Signing and verification with it are fast.
What does not fit in a browser
Three things exceed the 30-second budget. apqc_require
names them and says what to run instead, rather than letting a cell die
silently at the limit.
To run everything without limits, including the full 462-check test suite against NIST's ACVP vectors:
git clone https://github.com/AppliedPQC/AppliedPQC
cd AppliedPQC/sage
./fetch_vectors.sh
sage test_kat.sageEvery listing in the book
All 106 code listings from the chapters, runnable the same way. Each cell replays its chapter's earlier listings first, so any snippet can be tried on its own.
Nothing matches that.