Launching today
Post-Quantum Pretty Good Privacy PQ-PGP
Composite post-quantum cryptography in accordance RFC 9980
2 followers
Composite post-quantum cryptography in accordance RFC 9980
2 followers
The mandatory combination of lattice-based algorithms (ML-KEM and ML-DSA) with classical elliptic curves guarantees total protection. The data remains protected both against tomorrow's quantum computers and against unknown mathematical weaknesses in the new algorithms.
Free
Launch tags:Encryption
Launch Team
CloudflareYour next app belongs on Cloudflare Workers. Deploy for free
Promoted
PQ-PGP is a self-contained browser application that implements composite post-quantum OpenPGP cryptography in accordance with RFC 9980. The application pairs a NIST-standardised lattice-based primitive (ML-KEM from FIPS 203, ML-DSA from FIPS 204) with a classical elliptic-curve primitive (X25519 or X448 for ECDH, Ed25519 or Ed448 for EdDSA) at each cryptographic operation, deriving the wrapping key from both legs via the HKDF-SHA256.
Try it (WebApp): https://sh3lly.byethost11.com/pq-pgp
Technical Report: https://github.com/AoiAsahina/PQ-PGP/blob/main/PQ-PGP.pdf
Introduction: the quantum era of PGP
Post-Quantum PGP (Pretty Good Privacy) represents the evolution of the email and file encryption standard to resist the threat of future quantum computers, which will be able to break traditional asymmetric algorithms — such as RSA and ECC — via Shor's algorithm. This technological transition is not a simple cipher upgrade; it is a complete architectural reworking of how OpenPGP derives keys, signs messages, and protects private keys at rest.
The transition is officially defined at a global level by the IETF standard RFC 9980 (Post-Quantum Cryptography in OpenPGP), published in mid-2026 as a Proposed Standard, which extends the recent Crypto Refresh of the OpenPGP standard (RFC 9580). The document defines composite schemes based on ML-KEM (formerly CRYSTALS-Kyber, FIPS 203) for encryption and ML-DSA (formerly CRYSTALS-Dilithium, FIPS 204) for signatures, paired with classical elliptic curves, as well as SLH-DSA (formerly SPHINCS+, FIPS 205) as an ultra-conservative standalone signature scheme.
Technical architecture: the PQ/T hybrid approach
Because post-quantum algorithms are relatively new compared to decades of cryptanalysis on RSA and ECC, the cryptographic community has adopted a Post-Quantum / Traditional (PQ/T) hybrid strategy, also known as a composite construction. The fundamental principle is combined security: a message remains safe as long as at least one of the two algorithms — the classical one or the post-quantum one — remains unbroken. This hedge protects simultaneously against the future quantum computer and against unknown mathematical weaknesses in the new lattice-based algorithms.
Message encryption (composite KEM)
To protect data in transit from the Harvest Now, Decrypt Later attack — intercepting encrypted data today to decrypt it in the future with a quantum computer — OpenPGP introduces composite schemes based on ML-KEM combined with elliptic curves. The process has three phases:
• 1) an ephemeral symmetric session key is generated using AES-256;
• 2) this key is encapsulated twice — once with the classical algorithm and once with the post-quantum one;
• 3) the two outputs are cryptographically combined via SHA-256-based KDFs.
The mandatory and recommended combinations defined in RFC 9980 are:
➤ MUST: ML-KEM-768 + X25519 (Algorithm ID 35) — NIST Level 3, equivalent to AES-192.
➤ SHOULD: ML-KEM-1024 + X448 (Algorithm ID 36) — NIST Level 5, equivalent to AES-256, for ultra-sensitive long-term data.
Digital signatures (authentication and integrity)
To ensure that the sender's identity cannot be forged by a quantum computer, signatures use the ML-DSA standard (FIPS 204) in composite mode, or SLH-DSA (FIPS 205) in standalone mode. In composite signatures, the application must successfully verify both signatures — the classical and the post-quantum one — to consider the message valid. SLH-DSA is instead used alone: its security relies solely on hash trees, and is therefore considered ultra-secure, but with very large signatures (7–30 KB) and high signing times.
➤ MUST: ML-DSA-65 + Ed25519 (Algorithm ID 30) — NIST Level 3.
➤ SHOULD: ML-DSA-87 + Ed448 (Algorithm ID 31) — NIST Level 5, required by CNSA 2.0 fornational-security systems.
➤ Standalone (optional): SLH-DSA-128s, SLH-DSA-128f, SLH-DSA-256s — based solely on hash functions, ideal for long-term trust anchors.
NIST SP 800-38F: AES Key Wrap for symmetric keys
The relationship between the OpenPGP v6 / Post-Quantum ecosystem (RFC 9580 / RFC 9980) and the NIST SP 800-38F protocol (AES Key Wrap) focuses on a hyper-specific task: the encapsulation and protection of private symmetric keys within data packets. While AEAD modes (GCM, OCB, EAX) encrypt the message body, the NIST SP 800-38F standard intervenes one step earlier, acting as a security shield for the keys themselves.
The specification defines AES-based Key Wrapping methods (KW and KWP): a form of authenticated encryption specifically designed to protect high-entropy data (other cryptographic keys) rather than text streams. In OpenPGP v6 certificates this protocol is used in combination with Argon2id:
• 1) the user enters the passphrase;
• 2) Argon2id processes the passphrase and derives a symmetric Key Encryption Key (KEK);
• 3) the software uses this KEK to decrypt the actual OpenPGP private key — classical or post-quantum — which is wrapped on disk using AES-KW / AES-KWP.