quantum-safe: Bridging the Post-Quantum Production Gap with a Hybrid-by-Default Python Cryptography Library

• URL: http://arxiv.org/abs/2605.17061v1
• Date: Sat, 16 May 2026 16:05:11 GMT
• Title: quantum-safe: Bridging the Post-Quantum Production Gap with a Hybrid-by-Default Python Cryptography Library
• Abstract summary: quantum-safe is a Python that closes all three critical gaps in post-quantum cryptography.<n>We score nine PQC libraries across eight production-readiness dimensions.<n>A full X25519 + ML-KEM-768 handshake completes in 243 s under Docker/ Linux.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The August 2024 finalisation of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) closed the algorithmic gap in post-quantum cryptography (PQC). The production gap -- hybrid combiners, versioned key formats, protocol helpers, and migration tooling -- remains open. We present quantum-safe, a Python library that closes all three critical gaps we identify, and a systematic evaluation of the nine-library ecosystem that quantifies them. We score nine PQC libraries across eight production-readiness dimensions. Three dimensions have coverage below 35%: hybrid KEM support (11%), migration tooling (22%), and protocol integration (33%). quantum-safe scores Full on all eight. The full API reduces the hybrid KEM task from 45 lines of manual combiner code to three lines, directly lowering the risk of insecure combiner implementations. We report the first statistically rigorous per-operation overhead measurement for a Python hybrid PQC library (3,000 iterations, CPU-pinned, bootstrapped 95% confidence intervals). A full X25519 + ML-KEM-768 handshake completes in 243 μs under Docker/Linux -- 0.5--2.5% of a typical TLS 1.3 round-trip budget. At 5,000 concurrent users, throughput holds at 2,848 ops/s with only 4.9% degradation versus the single-user baseline, confirming that liboqs releases the Python GIL during C-level operations. We introduce Coefficient of Variation (CoV) as a practical timing side-channel proxy across all FIPS 203/204 operations. ML-KEM-768 decapsulation achieves CoV = 3.9%, within the AES-256-GCM noise floor (2.1%). ML-DSA-65 signing shows CoV = 51.5%, expected from FIPS 204 rejection sampling, not a side-channel. This CoV methodology has not previously been applied to PQC library evaluation and provides a lightweight complement to formal constant-time verification tools. All results are reproducible via a single Docker command.

Related papers

• JustFit: 200K-Token LLM Serving on a 24 GiB Laptop with Just-in-Time State Management [5.210656026160777]
  We present an MLX-based inference runtime that combines KVExec for compressed KV execution, PhaseSwap for component residency, and StateTransSwap for state-preserving serving transitions.<n>The integrated runtime answers 29 of 30 AIME 2026 problems correctly.
  arXiv  Detail & Related papers  (2026-09-15T17:15:48Z)
• QK-Normed MLA: QK normalization without full key caching [65.51862319225098]
  We show that QK normalization is a practical stabilization option for MLA models without requiring full-key caching.<n>In our 400M runs trained for up to 100B tokens, QK-Normed MLA achieves lower training loss and better downstream accuracy than QK clipping.
  arXiv  Detail & Related papers  (2026-06-15T07:16:30Z)
• The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort [51.56484100374058]
  Spracklen et al. showed that code-generating large language models hallucinate package names that do not exist on PyPI or npm.<n>We measure hallucination rates across 199,845 paired Python and JavaScript prompts validated against PyPI and npm master lists.<n>We identify a set of 127 package names (109 on PyPI, 18 on npm) that all five evaluated models invent identically.
  arXiv  Detail & Related papers  (2026-05-16T16:08:52Z)
• Measuring Maximum Activations in Open Large Language Models [60.3514350516308]
  We measure global and layerwise maxima on 27 checkpoints from 8 open families spanning dense, MoE, vision-language, intermediate-training, and instruction-tuned variants.<n>We conclude that maximum activation magnitude is a model property tied to family, architecture, and training stage - not a simple byproduct of size.
  arXiv  Detail & Related papers  (2026-05-15T03:31:51Z)
• Delta-Based Neural Architecture Search: LLM Fine-Tuning via Code Diffs [48.83701310501069]
  Large language models (LLMs) show strong potential for neural architecture generation.<n>Existing approaches produce complete model implementations from scratch.<n>We propose Delta-Code Generation, where fine-tuned LLMs generate compact unified diffs.
  arXiv  Detail & Related papers  (2026-05-06T13:32:05Z)
• Quantum-Safe Code Auditing: LLM-Assisted Static Analysis and Quantum-Aware Risk Scoring for Post-Quantum Cryptography Migration [0.0]
  Quantum-Safe Code is a quantum-aware static analysis framework.<n>It uses 15 classes of quantum-vulnerable primitives and a Variational Bouncysolver (VQE) model.<n>On a sample of 602 labelled instances, we achieve 71.98% precision, 100% recall, and an F1 score of 83.71%.
  arXiv  Detail & Related papers  (2026-04-01T07:10:17Z)
• Benchmarking Post-Quantum Cryptography on Resource-Constrained IoT Devices: ML-KEM and ML-DSA on ARM Cortex-M0+ [0.0]
  This paper presents the first isolated algorithm-level benchmarks of ML-KEM and ML-DSA on ARM Cortex-M0+ processors.<n>Using PQClean reference C implementations, we measure all three security levels of ML-KEM across key generation, encapsulation/signing, and decapsulation/verification.<n>All code, data, and scripts are released as an open-source benchmark suite for developers.
  arXiv  Detail & Related papers  (2026-03-19T11:27:29Z)
• Post-Quantum Entropy as a Service for Embedded Systems [0.0]
  We build a Quantum Entropy as a Service (QE) system that moves QRNG-derived entropy from a Quantis device to ESP32-class clients over post-quantum-secured channels.<n>On the server side, the design exposes two paths: direct quantum entropy through a custom OpenSSL provider and mixed entropy through the Linux system pool.
  arXiv  Detail & Related papers  (2026-03-10T23:09:55Z)
• Faster Post-Quantum TLS 1.3 Based on ML-KEM: Implementation and Assessment [5.483288991845528]
  TLS is extensively utilized for secure data transmission over networks. To counter quantum threats, it is imperative to integrate post-quantum algorithms into TLS. For the TLS protocol, handshake performance is crucial, and for post-quantum TLS (PQ-TLS) the performance of post-quantum key encapsulation mechanisms (KEMs) directly impacts handshake performance.
  arXiv  Detail & Related papers  (2024-04-21T05:59:04Z)
• KVQuant: Towards 10 Million Context Length LLM Inference with KV Cache Quantization [67.74400574357472]
  LLMs are seeing growing use for applications which require large context windows, and with these large context windows KV cache activations surface as the dominant contributor to memory consumption during inference.<n> Quantization is a promising approach for compressing KV cache activations; however, existing solutions fail to represent activations accurately in sub-4-bit precision.<n>Our work, KVQuant, facilitates low precision KV cache quantization by incorporating several novel methods.
  arXiv  Detail & Related papers  (2024-01-31T18:58:14Z)
• Composably secure data processing for Gaussian-modulated continuous variable quantum key distribution [58.720142291102135]
  Continuous-variable quantum key distribution (QKD) employs the quadratures of a bosonic mode to establish a secret key between two remote parties. We consider a protocol with homodyne detection in the general setting of composable finite-size security. In particular, we analyze the high signal-to-noise regime which requires the use of high-rate (non-binary) low-density parity check codes.
  arXiv  Detail & Related papers  (2021-03-30T18:02:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.