Getting started
quantum-resistant-rustykey is a TypeScript-first npm package of WebAssembly post-quantum primitives for Node.js and browsers — including SQIsign (NIST additional-signatures / on-ramp), ML-DSA, FN-DSA, SLH-DSA, and ML-KEM.
RustyKey® is a FIDO Alliance member. This package exists especially for constrained WebAuthn / CTAP2 contexts where lattice signatures are too large for the classic ~1024-byte buffer.
:::caution Pre-production
Await v1.0.0 (after security audit) for production / regulated deployment. Until then, prefer @latest or a caret range so dependents pick up patches.
:::
Install
pnpm i quantum-resistant-rustykey@latest
# or
bun add quantum-resistant-rustykey@latest
npm add quantum-resistant-rustykey@latest
TypeScript types
Types ship inside the package (dist/index.d.ts, wired through package.json "types" / exports). After install, editors and tsc resolve them automatically — do not install a separate DefinitelyTyped package:
# Not needed — there is no @types/quantum-resistant-rustykey
# pnpm i -D @types/quantum-resistant-rustykey
Useful named exports include IFnDsa, IMlKem, KeyPair, MlKemKeyPair, BytesLike, and EncryptResult. See API overview and the security note on what types do / do not prove.
What you get
| Family | Variants | Notes |
|---|---|---|
| SQIsign | L1 / L3 / L5 | Small signatures; NIST on-ramp. See cose-sqisign. |
| ML-DSA | 65 / 87 | NIST FIPS 204 |
| FN-DSA | 512 / 1024 | Falcon family |
| SLH-DSA | 128s / 192s / 256s | Hash-based FIPS 205 (pure JS via @noble/post-quantum) |
| ML-KEM | 512 / 768 / 1024 | From mlkem-native |
Quick taste (ML-KEM)
import { loadMlKem768, type IMlKem } from "quantum-resistant-rustykey";
const kem: IMlKem = await loadMlKem768();
const kp = kem.keypair();
const enc = kem.encrypt(kp.get("public_key"));
const sharedA: ArrayBuffer = await enc.get("secret");
const sharedB: ArrayBuffer = await kem.decrypt(enc.get("cyphertext"), kp.get("private_key"));
Live playground
Try algorithms interactively at pqc.rustykey.me.