Post-Quantum Cryptography

[amlord]

Hello! Following the approval by NIST of 3 Post-Quantum Cryptography standards, is there a plan to support these for encryption and signing?

[avivkeller]

@nodejs/crypto

[tniessen]

I can see at least four possible ways forward:

• Wait for Node.js to add these algorithms. It will take a while for OpenSSL to adopt these algorithms, and then it will take a while for Node.js to link against an OpenSSL version that does support these algorithms, and then it will take a while for Node.js to implement proper public APIs for these algorithms. This process might take years.
• Write a custom OpenSSL provider and use it from within Node.js. In OpenSSL 3, you could implement your own provider that provides these algorithms. It might still be challenging to use it from within Node.js applications, so this likely requires a lot of work.
• Wait for the Web Cryptography API to adopt these algorithms. This comes with the same challenges as the first option, and will likely take years (or it might never happen at all). See Support for PQC algorithms: ML-KEM, ML-DSA and SLH-DSA ? w3c/webcrypto#367.
• Use an npm package. I maintain, when I have time, node-pqclean, which exposes all algorithms supported by PQClean to Node.js applications. The underlying cryptographic algorithms are compiled to a Node.js native addon, which can then be used by JavaScript code. If you find an issue with this library, please open an issue in the node-pqclean repository. There are likely many other npm packages, too.

[tniessen]

Here's the relevant Web Crypto API issue: w3c/webcrypto#367