sk_pqc 0.1.0

Hybrid post-quantum key encapsulation (X25519 + ML-KEM-768, FIPS 203) for Dart and Flutter across web and native. Binds audited primitives (liboqs, noble-post-quantum) with a standard HKDF-SHA256 hybr [...]

Changelog

0.1.0

Initial release.

• Hybrid post-quantum KEM with suite id x25519-mlkem768 (X25519 + ML-KEM-768, FIPS 203).
• One HybridKem Dart API with two backends behind a conditional import:
  • native (dart:ffi) → liboqs OQS_KEM ML-KEM-768.
  • web (dart:js_interop) → @noble/post-quantum ml_kem768.
  • X25519 on both via package:cryptography.
• HKDF-SHA256 hybrid combiner (HKDF-SHA256(X25519_ss ‖ MLKEM768_ss, salt, info)), the only original cryptographic code, tested against RFC 5869 and hand-computed vectors.
• Documented wire format (1216-B public key, 2432-B private key, 1120-B ciphertext, 32-B shared secret) as the cross-implementation interop contract.
• Test coverage: combiner KATs, ML-KEM-768 KAT vs NIST ACVP FIPS 203 keyGen, cross-backend (noble ↔ liboqs both directions), round-trips, malformed-input handling, and a JSON interop test vector verified by Dart, liboqs, noble, and Python (tool/verify_vector.py).

Known limitations

• KEM only — no signatures (ML-DSA / SLH-DSA are future work).
• v1 ships and tests the FFI path on Linux desktop. Per-arch liboqs binaries for Android/iOS/macOS/Windows are a documented CI follow-up.
• The web backend's assurance depends on @noble/post-quantum.