Modular Crypto as a Service (CaaS) Solutions — Crypto Service Suite
Crypto Service Suite provides self-hostable Cryptography-as-a-Service (CaaS) building blocks across 18 lockstep libraries: FIPS 203/204 algorithms (via @noble/post-quantum; not a validated cryptographic module), a KMS interface, and transparent database field encryption.
Post-Quantum Cryptography
NIST FIPS 203 ML-KEM and FIPS 204 ML-DSA algorithms, plus classical + ML-KEM hybrid KEMs.
Self-Hosted CaaS Service & SDK
Self-hosted Fastify REST service, typed client SDK, and interactive CLI.
KMS Interface
Uniform provider interface. AWS KMS and a local provider are implemented; GCP, Azure and Vault are stubs.
Database & Middleware Encryption
Transparent column-level encryption for Prisma ORM, TypeORM, and Express/Fastify request middleware.
Edge Runtime Support
Web Crypto adapter for Cloudflare Workers, Vercel Edge, Deno, Bun and browsers.
CBOM, LSP & AI Agent Tooling
CycloneDX 1.6 CBOM generator for cryptographic inventories, Language Server Protocol, and Model Context Protocol (MCP).
# 1. Install (0.0.8 or later)
pnpm add @sebastienrousseau/crypto-lib
// 2. ML-KEM-768 key encapsulation (FIPS 203 algorithm)
import { mlKemKeygen, mlKemEncap, mlKemDecap } from "@sebastienrousseau/crypto-lib";
const kem = mlKemKeygen(768);
const { ciphertext, sharedSecret } = mlKemEncap(768, kem.publicKey);
const received = mlKemDecap(768, kem.secretKey, ciphertext);
1. Post-Quantum Enclaves & Hybrid Key Encapsulation
A cryptographically relevant quantum computer running Shor's algorithm would break RSA, Diffie-Hellman, and elliptic-curve cryptography. You can start using NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) algorithms today; crypto-lib implements them via @noble/post-quantum, which is not a validated cryptographic module.
Under the Harvest Now, Decrypt Later (HNDL) attack model, state actors record encrypted traffic today for future decryption. Hybrid schemes are designed so that an adversary must break both the classical and the lattice component to recover the shared secret.
FIPS 203 (ML-KEM) Algorithms
@sebastienrousseau/crypto-lib exposes ML-KEM-512, ML-KEM-768 and ML-KEM-1024 through @noble/post-quantum. ML-KEM-768 targets NIST security category 3 and has 1,088-byte ciphertexts.
Composite Dual-Layer Hybrid Schemes
Combines a classical curve (X25519, NIST P-256 or X448) with ML-KEM and derives the session key from both shared secrets, so an attacker must break both components to recover it.
FIPS 204 (ML-DSA) Digital Signatures
Lattice-based digital signatures (ML-DSA-44/65/87) via @noble/post-quantum. ML-DSA-65 targets NIST security category 3. @noble/post-quantum does not guarantee constant-time execution.
Memory Hygiene & Entropy
Randomness comes from the platform CSPRNG. crypto-lib exports wipeMemory() and SecureBuffer for callers, but its own APIs do not zeroize intermediate state, and keys passed as hex strings cannot be wiped.
2. Sovereign Crypto-as-a-Service Daemon & Client SDK
Third-party hosted platforms introduce counterparty risk and vendor lock-in. Crypto Service Suite lets you run a self-hosted CaaS tier in your private cloud or on-premises data centre.
Your applications call the service over a REST API. Keys you manage with it stay on infrastructure you control.
Fastify REST Microservice
@sebastienrousseau/crypto-server exposes crypto-lib operations behind documented REST endpoints, with rate limiting and OpenTelemetry instrumentation. No throughput figures are published yet.
Type-Safe Zero-Dependency SDK
@sebastienrousseau/crypto-sdk is a zero-dependency, fetch-based TypeScript client with typed request and response bindings.
Interactive CLI
The @sebastienrousseau/crypto-cli package offers key pair generation, encryption, signing, hashing and CBOM generation from an interactive terminal menu. It has no non-interactive flags, so it is not suited to scripts or CI pipelines.
Self-Hosted Deployment
Run the service inside your private VPC or on-premises infrastructure. OpenTelemetry export is off unless you set OTEL_EXPORTER_OTLP_ENDPOINT.
3. KMS Interface
@sebastienrousseau/crypto-kms defines one TypeScript interface for key management backends. Today the AWS KMS and local in-memory providers are implemented. The Google Cloud, Azure and HashiCorp Vault providers are stubs that reject every call with Not implemented.
generateDataKey() supports envelope encryption: data encryption keys (DEKs) are wrapped by a key encryption key (KEK) held by the provider.
AWS KMS (implemented)
AwsKmsProvider calls AWS Key Management Service through @aws-sdk/client-kms. There is no direct CloudHSM integration.
Google Cloud KMS (stub)
GcpKmsProvider exists as an interface placeholder; every method rejects with Not implemented.
Azure Key Vault (stub)
AzureKmsProvider exists as an interface placeholder; every method rejects with Not implemented.
HashiCorp Vault (stub) & PKCS#11 (simulation)
VaultKmsProvider is a stub. Pkcs11HsmProvider is an in-memory software simulation for tests: it has no PKCS#11 binding, talks to no HSM, and requires simulate: true.
4. Transparent Database Field-Level Encryption
Securing sensitive customer records, financial ledgers, and authentication credentials requires robust ciphertext-at-rest. You can encrypt individual database columns automatically in Prisma and TypeORM without breaking database schemas or application business logic.
Decryption happens in application memory when queries return. Database dumps and storage snapshots hold only ciphertext for the configured fields.
Prisma ORM Field-Level Encryption
@sebastienrousseau/crypto-prisma provides transparent extension middleware for Prisma Client. Configured fields are encrypted with XChaCha20-Poly1305 before they are written and decrypted on read; fields marked deterministic are stored as HMAC-SHA256 values for equality search.
TypeORM Column Decorators
@sebastienrousseau/crypto-typeorm provides an @EncryptedColumn() decorator and transformer for TypeORM entities, encrypting column values with XChaCha20-Poly1305.
Express & Fastify Middleware
@sebastienrousseau/crypto-middleware decrypts inbound request payloads, verifies HMAC signatures and HS256 JWTs, and encrypts outbound responses in Express and Fastify.
Client-Side React & Vue Hooks
Secure end-to-end data encryption before transmission using @sebastienrousseau/crypto-react (useEncrypt, useKeypair, useHash, useSignature) and @sebastienrousseau/crypto-vue composables with reactive state management.
5. Edge Runtime Support
All cryptography in the suite runs in JavaScript (the @noble/* libraries and OpenPGP.js) or through the platform Web Crypto API. There is no WebAssembly code in the suite today.
WebAssembly: not yet implemented
@sebastienrousseau/crypto-wasm is a placeholder package. It contains no WebAssembly module, so it provides no acceleration.
Edge Runtimes
@sebastienrousseau/crypto-edge adapts crypto-lib to Cloudflare Workers, Vercel Edge, Deno, Bun and browsers, with runtime detection and text/base64 fallbacks. Randomness is never polyfilled.
No constant-time guarantee
The suite has not been verified against timing side channels, and @noble/post-quantum does not guarantee constant-time execution.
6. CBOM, Developer LSP & AI Agent MCP
A cryptographic inventory is a common input to DORA (EU 2022/2554) ICT risk work. You can generate machine-readable CycloneDX 1.6 Cryptographic Bills of Materials (CBOM) from your source code. Generating a CBOM does not by itself make a system compliant.
Developer IDEs and autonomous AI agents receive native cryptographic intelligence through the Language Server Protocol (LSP) and Model Context Protocol (MCP), flagging weak or quantum-vulnerable algorithm names and offering quick fixes.
CycloneDX 1.6 & SPDX 3.0 CBOM
@sebastienrousseau/crypto-cbom scans source code for algorithm usage and generates CycloneDX 1.6 or SPDX 3.0 Cryptographic Bill of Materials (CBOM) documents.
Language Server Protocol (LSP)
@sebastienrousseau/crypto-lsp is a language server that works with any LSP client. Pattern rules flag deprecated algorithms (MD5, SHA-1, DES), short RSA keys and quantum-vulnerable public-key algorithms, with code actions for some findings.
Model Context Protocol (MCP) for AI
@sebastienrousseau/crypto-mcp exposes crypto-lib operations, key generation and KMS tools to AI assistants through the Model Context Protocol.
Test Fixtures
@sebastienrousseau/crypto-testing supplies synthetic test keys (including RFC 8032 and RFC 7748 vectors), fixtures and mocks for code that uses crypto-lib.