@brivora/crypto

Post-quantum cryptography in 3 lines of TypeScript.

import { crypto } from '@brivora/crypto';
const keys = await crypto.createIdentity();
const signed = await crypto.sign(data, keys.privateKey);

What is this?

@brivora/crypto is an opinionated, batteries-included post-quantum cryptography library for JavaScript/TypeScript. The "Stripe for PQC."

• Hybrid by default — Classical (Ed25519 + X25519) + Post-Quantum (ML-DSA-65 + ML-KEM-768). Both must be broken to compromise security.
• NIST FIPS compliant — ML-KEM-768 (FIPS 203), ML-DSA-65 (FIPS 204), finalized August 2024.
• Self-describing payloads — Every encrypted/signed payload includes version and algorithm metadata.
• Zero configuration — Sensible defaults. No crypto PhD required.
• Pure TypeScript — No native modules. No WASM. Works everywhere: Node.js, Deno, Bun, browsers.
• Zero telemetry — No analytics. No network calls. Pure local computation.

Install

npm install @brivora/crypto
# or
pnpm add @brivora/crypto
# or
yarn add @brivora/crypto

Quick Start

Create an Identity

import { crypto } from '@brivora/crypto';

const identity = await crypto.createIdentity();
// {
//   publicKey: { classical: { signing, encryption }, pqc: { signing, encryption } },
//   privateKey: { classical: { signing, encryption }, pqc: { signing, encryption } },
//   fingerprint: 'a1b2c3d4...',
//   algorithm: 'hybrid-pqc-v1',
//   createdAt: '2026-02-13T...'
// }

Encrypt & Decrypt

// Alice encrypts a message for Bob
const encrypted = await crypto.encrypt('secret message', bob.publicKey);

// Bob decrypts
const plaintext = await crypto.decrypt(encrypted, bob.privateKey);
// Uint8Array → use new TextDecoder().decode(plaintext) for strings

Sign & Verify

// Sign data
const signed = await crypto.sign('important data', alice.privateKey);

// Verify signature
const { valid, data } = await crypto.verify(signed, alice.publicKey);
// valid: true, data: Uint8Array of original data

Key Rotation

const { newIdentity, migration } = await crypto.rotateKeys(oldIdentity);
// migration is a signed proof linking old key → new key

Key Derivation

const masterKey = crypto.randomBytes(32);
const encKey = crypto.deriveKey(masterKey, 'encryption');
const authKey = crypto.deriveKey(masterKey, 'authentication');
// Different contexts → different deterministic keys

Migrate from Ed25519

const upgraded = await crypto.upgradeKey({
  publicKey: existingEd25519PublicKey,
  secretKey: existingEd25519SecretKey,
});
// upgraded.identity is now a hybrid PQC identity
// upgraded.migration is a signed proof of the upgrade

PQC-Only Mode

// Disable classical crypto (PQC-only)
const encrypted = await crypto.encrypt(data, pubKey, { hybrid: false });
const signed = await crypto.sign(data, privKey, { hybrid: false });

API Reference

Identity

Encryption

Signatures

Key Management

Migration

Utilities

Algorithms

How Hybrid Mode Works

Encryption (X25519 + ML-KEM-768)

1. Generate ephemeral X25519 key pair
2. Compute classical shared secret via X25519 ECDH
3. Encapsulate PQC shared secret via ML-KEM-768
4. Combine both secrets via HKDF-SHA256
5. Encrypt plaintext with AES-256-GCM

An attacker must break both X25519 and ML-KEM-768 to recover the plaintext.

Signing (Ed25519 + ML-DSA-65)

1. Sign data with Ed25519
2. Sign data with ML-DSA-65
3. Both signatures must verify for the payload to be valid

An attacker must forge both an Ed25519 and ML-DSA-65 signature.

Tree Shaking

Import only what you need:

// Only signing — no encryption code in your bundle
import { sign, verify, createIdentity } from '@brivora/crypto';

Security

• Constant-time comparisons — All byte comparisons use constant-time algorithms to prevent timing side-channels.
• CSPRNG — All random bytes from crypto.getRandomValues() (OS-level CSPRNG).
• No network calls — Everything runs locally. Zero telemetry. Zero analytics.
• Audited primitives — Built on @noble/post-quantum (audited by Cure53).

See SECURITY.md for our security policy and responsible disclosure process.

Requirements

• Node.js 20+ (also works in Deno, Bun, and modern browsers)
• Web Crypto API (globalThis.crypto.subtle)

Built On

• @noble/post-quantum — ML-KEM, ML-DSA (audited)
• @noble/hashes — SHA-2, SHA-3, HKDF
• @noble/curves — Ed25519, X25519

License

AGPL-3.0-or-later — Brivora, LLC