# PQC Tasks

Internal working plan for post-quantum cryptography.

Last external source check: 2026-05-16.

## Position

PQC is real work now, but it should not become algorithm sprawl.

Build primitives first, composition helpers second, and protocol glue last.
Every primitive needs a portable constant-time baseline, official vectors,
malformed-input tests, and benchmark coverage before acceleration matters.

## Standards Baseline

Current baseline:

- `ML-KEM`: FIPS 203 final.
- `ML-DSA`: FIPS 204 final.
- `SLH-DSA`: FIPS 205 final.
- KEM guidance: SP 800-227 final.

Watch list:

- `HQC`: selected by NIST for future standardization, not first-wave implementation.
- `FN-DSA` / Falcon: active FIPS 206 track, not a settled implementation target.
- Additional `SLH-DSA` parameter sets: SP 800-230 initial public draft, not a general baseline.
- Hybrid TLS 1.3: RFC-to-be 9954 was in AUTH48 as of the source check.
- PQ / hybrid HPKE: active IETF draft work.

## Build Order

### 1. ML-KEM

First target.

- [ ] ML-KEM-768.
- [ ] ML-KEM-512.
- [ ] ML-KEM-1024.
- [ ] key generation from deterministic seeds where the standard allows it.
- [ ] encapsulation and decapsulation.
- [ ] explicit ciphertext validation and failure handling.
- [ ] zeroization for decapsulation secrets and intermediate material.

Verify:

- [ ] official FIPS 203 vectors.
- [ ] malformed ciphertext tests.
- [ ] deterministic round-trip tests.
- [ ] no secret-dependent branches or table lookups.
- [ ] benchmark rows for keygen, encapsulate, decapsulate.

### 2. Hybrid Composition Helpers

Only after ML-KEM is correct.

- [ ] X25519 + ML-KEM shared-secret combiner.
- [ ] typed domain separation for hybrid KDF inputs.
- [ ] failure behavior that does not leak which component failed.
- [ ] no TLS-specific API in the primitive layer.

Verify:

- [ ] composition vectors where available.
- [ ] both classical and PQ components affect the final secret.
- [ ] malformed classical and PQ inputs fail closed.

### 3. ML-DSA

First PQ signature target.

- [ ] ML-DSA-65 first unless a concrete use requires another profile.
- [ ] ML-DSA-44 and ML-DSA-87 after the core implementation is stable.
- [ ] deterministic and randomized signing modes as required by the standard.
- [ ] strict public-key, secret-key, and signature encoding.

Verify:

- [ ] official FIPS 204 vectors.
- [ ] invalid signature and malformed encoding tests.
- [ ] side-channel review of rejection sampling and secret-dependent paths.
- [ ] benchmark rows for keygen, sign, verify.

### 4. SLH-DSA

Second signature family.

- [ ] start with the NIST baseline profiles.
- [ ] keep additional limited-use parameter sets out until SP 800-230 stabilizes.
- [ ] make state and signature-size costs explicit in the API docs.

Verify:

- [ ] official FIPS 205 vectors.
- [ ] malformed signature tests.
- [ ] benchmark rows that show signature-size and verification tradeoffs.

### 5. Protocol Glue

Do not start this until the primitives are boring.

- [ ] HPKE helper APIs after the IETF draft stabilizes.
- [ ] TLS hybrid group support inside `rscrypto-rustls`, not core.
- [ ] certificate and object-identifier mapping only after signature primitives exist.

Verify:

- [ ] protocol glue has no direct dependency back into core beyond primitives.
- [ ] provider advertises only implemented and tested groups.

## Not First

- HQC.
- FN-DSA.
- non-standard Kyber/Dilithium names in the public API.
- experimental parameter sets.
- broad PQC framework abstractions.

## Implementation Rules

- Portable constant-time baseline first.
- Acceleration is an optimization layer, never the algorithm boundary.
- No dependency tower.
- No secret-dependent memory access.
- Serialization must be strict.
- Malformed inputs must fail explicitly.
- Deterministic test vectors are mandatory before benchmarks.

Hardware expectations:

- x86_64: AVX2 likely matters for NTT and polynomial arithmetic.
- aarch64: NEON first; SVE2 only after real hardware measurements.
- scalar reference code must stay readable enough to audit.
- cache layout matters as much as instruction count.

## Sources

- FIPS 203 ML-KEM: https://csrc.nist.gov/pubs/fips/203/final
- FIPS 204 ML-DSA: https://csrc.nist.gov/pubs/fips/204/final
- FIPS 205 SLH-DSA: https://csrc.nist.gov/pubs/fips/205/final
- SP 800-227 KEM guidance: https://csrc.nist.gov/pubs/sp/800/227/final
- NIST PQC project: https://csrc.nist.gov/projects/post-quantum-cryptography
- NIST HQC selection: https://csrc.nist.gov/News/2025/hqc-announced-as-a-4th-round-selection
- FIPS 206 FN-DSA presentation: https://csrc.nist.gov/presentations/2025/fips-206-fn-dsa-falcon
- SP 800-230 initial public draft: https://csrc.nist.gov/pubs/sp/800/230/ipd
- Hybrid TLS status: https://www.rfc-editor.org/auth48/C553
- PQ / hybrid HPKE draft status: https://datatracker.ietf.org/doc/draft-ietf-hpke-pq/
