Self-host post-quantum encryption, a pluggable KMS interface, and transparent database field protection across our modular suite of 18 libraries.
# 1. Install cryptographic primitives
pnpm add @sebastienrousseau/crypto-lib
// 2. Post-quantum key encapsulation (ML-KEM-768, FIPS 203)
import { mlKemGenerateKeyPair, mlKemEncapsulate } from "@sebastienrousseau/crypto-lib";
const keyPair = mlKemGenerateKeyPair();
const { ciphertext, sharedSecret } = mlKemEncapsulate(keyPair.publicKey);
NIST has published ML-KEM (FIPS 203) and ML-DSA (FIPS 204). Crypto Service Suite implements both algorithms through @noble/post-quantum; it is not a validated cryptographic module.
Read more >
How to measure ML-KEM and ML-DSA latency on your own hardware with the committed benchmark script. No timing figures are published yet.
Read more >
Adversaries are actively archiving encrypted enterprise records. Discover why hybrid post-quantum key encapsulation must be integrated into cloud and database pipelines today.
Read more >Protect sensitive data, credentials, and API communication channels against Harvest-Now-Decrypt-Later (HNDL) adversaries. Implements the NIST FIPS 203 (ML-KEM) key encapsulation and FIPS 204 (ML-DSA) signature algorithms via @noble/post-quantum (not a validated module), plus hybrid X25519 + ML-KEM key encapsulation for coexistence with classical cryptography.
A Fastify REST microservice that exposes crypto-lib operations with rate limiting and OpenTelemetry instrumentation. Run it in your private cloud or on-premises data centre so keys you manage with it stay on infrastructure you control. No throughput figures are published yet.
One TypeScript interface for key management backends, with envelope encryption (DEK/KEK) through generateDataKey(). AWS KMS and a local in-memory provider are implemented; Google Cloud KMS, Azure Key Vault and HashiCorp Vault are stubs, and PKCS#11 is a software simulation with no HSM support.
Transparent column encryption for Prisma and TypeORM. A Prisma Client extension and a TypeORM @EncryptedColumn() decorator encrypt configured fields with XChaCha20-Poly1305 before they are written, so database dumps hold only ciphertext for those fields, without schema rewrites.
crypto-edge adapts crypto-lib to Cloudflare Workers, Vercel Edge, Deno, Bun, and browsers, with runtime detection and text/base64 fallbacks. All operations run in JavaScript or the platform Web Crypto API: crypto-wasm is a placeholder with no WebAssembly module, and there is no constant-time guarantee.
The algorithms below are implemented in crypto-lib on top of the @noble/* libraries; none is a validated cryptographic module. No timing figures are published yet: run node benchmarks/crypto-bench.ts from the repository to measure on your own hardware.
| Primitive | Mathematical Type | NIST Security Level | Package |
|---|---|---|---|
| ML-KEM-768 | Module-LWE Lattice (FIPS 203) | Level 3 (AES-192) | @crypto-lib |
| ML-DSA-65 | Module-SIS Lattice (FIPS 204) | Level 3 (AES-192) | @crypto-lib |
| Composite Hybrid | X25519 + ML-KEM-768 | Dual Quantum + Classical | @crypto-lib |
| AES-256-GCM | Authenticated Symmetric Cipher | FIPS 197 / SP 800-38D | @crypto-lib |
Envelope encryption through one KMS interface. AWS KMS and a local provider are implemented; Google Cloud, Azure and Vault are stubs, and there is no HSM support.
Learn more >Which NIST FIPS 203/204/205 and CNSA 2.0 algorithms are implemented (none validated), and which tools can support EU DORA work (no compliance claim).
Find out more >