PQSecure-SW™

High-Assurance Post-Quantum Cryptography Software

PQSecure-SW™ delivers production-grade, side-channel-aware, formally verified post-quantum cryptography software for embedded systems, secure boot, Root-of-Trust, defense platforms, and silicon-integrated deployments.

Our modular software stack includes:

  • libpqsecure-C – High-assurance portable C implementation
  • libpqsecure-rs – Memory-safe pure Rust implementation
  • libpqsecure-asm – Architecture-optimized assembly acceleration layer

Together, they provide portable, high-performance, quantum-safe cryptography engineered for real-world deployment.

✅ Algorithms Supported

PQSecure-SW™ implements finalized NIST standards, forthcoming standards, stateful hash-based signatures, and classical primitives required for hybrid deployments.

NIST Post-Quantum Standards

  • ✅ FIPS 203 – ML-KEM
  • ✅ FIPS 204 – ML-DSA
  • ✅ FIPS 205 – SLH-DSA (SPHINCS+)
  • ✅ FIPS 206 – FN-DSA (Falcon) (available soon)
  • ✅ FIPS 202 – SHA-3 (Keccak)

Stateful Hash-Based Signatures

  • ✅ RFC 8391 – XMSS
  • ✅ RFC 8554 – LMS
  • ✅ NIST SP 800-208 – Stateful Hash-Based Signatures

Classical Hash Standards

  • ✅ RFC 6234 – SHA-2, HMAC, HKDF

All implementations support relevant NIST security levels (1, 3, 5 where applicable) and are engineered for embedded, aerospace, defense, 5G, IoT, secure elements, and supply-chain-assured silicon deployments.

Background: Transition to Post-Quantum Cryptography

With the publication of FIPS 203, 204, 205, and the upcoming FIPS 206, the migration from RSA and ECC to quantum-safe cryptography has entered full deployment. Federal mandates (including CNSA 2.0 guidance) require adoption of NIST-standardized PQC algorithms in secure communications, firmware authentication, and Root-of-Trust systems.

Secure deployment requires more than algorithm compliance. It requires:

  • ✅ Constant-time implementations
  • ✅ Side-channel-aware design
  • ✅ Formal verification
  • ✅ Stack-aware embedded optimization
  • ✅ Hardware integration readiness

PQSecure-SW™ is engineered specifically for these high-assurance environments.

Software Stack Architecture

🔷 libpqsecure-C

High-assurance portable C implementation optimized for firmware, RTOS, secure boot, and silicon integration.

Key Features

  • ✅ Pure C implementation
  • ✅ Formally verified using CBMC
  • ✅ Strict constant-time discipline
  • ✅ Stack-optimized variants
  • ✅ ACVP-tested infrastructure
  • ✅ Portable across major toolchains
  • ✅ Designed for bare-metal, RTOS, and embedded Linux

🔷 libpqsecure-rs

Memory-safe Rust implementation designed for embedded and security-critical deployments.

Key Features

  • ✅ Pure Rust implementation
  • ✅ no_std support
  • ✅ Formally verified using Kani
  • ✅ Strict constant-time design
  • ✅ Memory-safe by construction
  • ✅ ACVP-tested infrastructure
  • ✅ Portable across Linux, macOS, Windows, RISC-V, ARM Cortex-M

🔷 libpqsecure-asm

Architecture-specific assembly acceleration layer delivering maximum performance on constrained MCUs and high-performance processors.

Optimized Backends

  • ✅ ARM Cortex-M3
  • ✅ ARM Cortex-M4 / M33
  • ✅ ARM Cortex-A series
  • ✅ RISC-V (RV32 / RV64)
  • ✅ x86-64

Capabilities

  • ✅ Optimized NTT implementations
  • ✅ Modular arithmetic acceleration
  • ✅ Polynomial multiplication acceleration
  • ✅ SHA acceleration (where supported)
  • ✅ Strict constant-time assembly primitives
  • ✅ DSP instruction utilization (M4/M33)
  • ✅ Optional vector acceleration (AVX2 / NEON)

libpqsecure-asm integrates seamlessly with both libpqsecure-C and libpqsecure-rs.

Code-Size Configuration Options

PQSecure-SW™ supports two deployment profiles:

🚀 Large Variant (Performance Optimized)

  • ✅ Maximum throughput
  • ✅ Stack-optimized implementations
  • ✅ Three ML-DSA sign stack/performance tradeoffs
  • ✅ Ideal for embedded Linux, gateways, defense systems

🔒 Small Variant (Low Stack Footprint)

  • ✅ Reduced stack usage
  • ✅ Lower performance than Large variant
  • ✅ Ideal for constrained MCUs and secure elements

Formal Verification & Assurance

PQSecure-SW™ integrates formal methods directly into production cryptographic software.

  • ✅ Rust verified using Kani
  • ✅ C verified using CBMC
  • ✅ Constant-time coding discipline
  • ✅ Side-channel-aware implementation
  • ✅ ACVP testing infrastructure
  • ✅ Designed for FIPS-oriented validation pathways

Continuous Integration & Embedded Validation

PQSecure-SW™ includes production-grade CI infrastructure:

  • ✅ Linux / macOS / Windows testing
  • ✅ RISC-V and ARM via QEMU
  • ✅ On-board embedded validation
  • ✅ Automated regression testing

CI Architecture (Option 3)

  • ✅ board-repo → hardware execution
  • ✅ crypto-repo → OS + QEMU validation
  • ✅ crypto-board-repo → automated cloning + board regression

Why PQSecure-SW™

PQSecure-SW™ is engineered specifically for:

  • ✅ Embedded environments
  • ✅ Secure boot & Root-of-Trust
  • ✅ Defense & aerospace systems
  • ✅ Silicon integration
  • ✅ Hardware / software co-design

We combine:

  • ✅ NIST compliance
  • ✅ Formal verification
  • ✅ Constant-time discipline
  • ✅ Assembly-level optimization
  • ✅ Embedded portability
  • ✅ Hardware acceleration readiness

to deliver production-ready, high-assurance quantum-safe cryptography.