systemslibrarian 

Roslyn analyzers for PostQuantum.Jwt: PQJWT001 forbids inspecting JOSE header fields (alg/jwk/jku/x5u/x5c) — the verification key comes from a trusted key ring, never the token — and PQJWT002 flags per-call... More information

A Redis-backed implementation of PostQuantum.Jwt's IPqJwtReplayCache, intended for horizontally-scaled deployments of PostQuantum.AspNetCore. Uses StackExchange.Redis SET NX with TTL = remaining token lifetime,... More information

Diagnostics CLI for PostQuantum.DataProtection. Install as a global dotnet tool: dotnet tool install --global PostQuantum.DataProtection.Cli. Currently supports: pq-dp inspect <path-to-key.xml> — prints... More information

AWS Secrets Manager-backed IPostQuantumKeyStore for PostQuantum.DataProtection. Stores ML-KEM-768 keypairs as Secrets Manager secrets (one secret per keypair plus a small "active" pointer secret). The PQ secret... More information

Shamir's Secret Sharing over GF(2^8) with authenticated, strict-CBOR share files: split signing keys and recovery keys K-of-N among trustees; ML-DSA-65 share authentication; information-theoretic security... More information

StackExchange.Redis-backed IPostQuantumKeyStore for PostQuantum.DataProtection. Stores ML-KEM keypairs in a Redis hash and the active key id in a single pointer key. Suitable for hosts that already use Redis... More information

dotnet new templates for PostQuantum.LMS.Signer, including a firmware-signer sample (HSS + FileStateStore keygen/sign/verify).

Test fakes for PostQuantum.DataProtection. Provides an in-memory IPostQuantumKeyStore (FakePostQuantumKeyStore) so consumer projects can write unit tests against their own code without standing up a real ML-KEM... More information

Azure Key Vault-backed IPostQuantumKeyStore for PostQuantum.DataProtection. Stores the ML-KEM-768 keypairs that wrap ASP.NET Core Data Protection keys in an Azure Key Vault Secrets vault — durable, audited, and... More information

OpenTelemetry instrumentation helper for PostQuantum.DataProtection. One-line wiring: builder.AddPostQuantumDataProtectionInstrumentation() on a MeterProviderBuilder and a TracerProviderBuilder, and the PQ... More information

The high-level post-quantum secure channel library for .NET. Three messages to a live session, mutually authenticated, forward-secret, replay-resistant, transport-agnostic. Built on X-Wing hybrid key agreement... More information

PostQuantum.LMS.Signer is a pure-managed .NET implementation of NIST SP 800-208 / RFC 8554 stateful hash-based signatures (LMS and HSS), built for firmware signing, secure boot, and code signing in the... More information

dotnet-cbom: command-line Cryptographic Bill of Materials generator for .NET.

Opt-in Verifiable Secret Sharing (Pedersen VSS) for PostQuantum.SecretSharing: detect a malicious dealer who issues inconsistent shares, with optional ML-DSA-65 signing of the commitment broadcast. Secrecy... More information

Opinionated, misuse-resistant message envelopes for PostQuantum.Hybrid. HybridEnvelope.Seal / Open wrap KEM + HKDF + AES-GCM into one call; SignedHybridEnvelope.Seal / Open add hybrid authentication on top.

Roslyn analyzers for PostQuantum.Hybrid. Detects common misuse patterns at build time: undisposed hybrid private keys, encapsulation results, and key pairs.

ASP.NET Core extensions for PostQuantum.Hybrid: dependency-injection helpers for loading hybrid KEM and signature keys from configuration, plus opinionated IHybridKeyProvider abstractions.

Test helpers for projects that consume PostQuantum.Hybrid. Cached deterministic test keys (HybridTestKeys), fake KemKeyProvider / SignatureKeyProvider, and tamper-injection helpers for negative-path tests.

The foundation post-quantum cryptography library for .NET 10. Clean, high-level, secure-by-default wrappers over the BCL's native FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) implementations across all parameter... More information

ASP.NET Core integration for PostQuantum.SecureChannel. Adds AddPostQuantumSecureChannel() DI registration with IConfiguration binding (server identity seed, pinned client keys, session preset), a... More information