Post-Quantum Encryption from Java, Python, Node or Go

Most information systems are not written in a single language. A Java application handles orders, a Python service produces reports, a Node back office exchanges documents with partners. Making all of it post-quantum by embedding a cryptographic library in each one means as many projects, native dependencies and security reviews.

There is a simpler way. Take the cryptography out of the applications.

The sidecar pattern

The sidecar of Feranor PQC Suite is a small service that runs next to your applications, in the same Kubernetes pod, on the same host or in the same Docker Compose project. It holds the keys, does the cryptography, and exposes an HTTP API. Your applications send it a file, and it returns an encrypted or signed message.

• No cryptographic library to embed. An HTTP client is enough, and every language has one.
• Keys never leave the sidecar. Applications never see a private key; the key store's secret comes from a mounted file or from your vault (Azure Key Vault, AWS Secrets Manager, Google Cloud Secret Manager, HashiCorp Vault).
• A Unix socket by default. Only the processes of the sidecar's group can call it; over the network, an access token is required.
• Every operation journaled. A chained audit journal records what was encrypted, decrypted, signed or verified, without ever writing the content into it.
• Files of any size. Content is streamed, in constant memory.

Encrypt and decrypt in two calls

From a shell, with curl on the socket, you fetch the recipient's certificate, encrypt, then decrypt.

S=/run/feranor/sidecar.sock
RECIPIENT=$(curl -s --unix-socket $S http://localhost/v1/recipient | sed '1d;$d' | tr -d '\n')
curl -s --unix-socket $S -H "Feranor-Recipient: $RECIPIENT" --data-binary @report.pdf http://localhost/v1/encrypt -o report.pdf.p7m
curl -s --unix-socket $S --data-binary @report.pdf.p7m http://localhost/v1/decrypt -o report.pdf

The message produced is a standard CMS message (RFC 5652), encrypted with hybrid ML-KEM-1024 and ECDH P-384 under the ANSSI profile. Any conforming CMS tool can read its structure.

From Python

Over the network, the sidecar listens on TCP with an access token. Encrypting and signing a file for a partner takes a few lines.

import requests

SIDECAR = "http://feranor-sidecar:8080"
TOKEN = open("/run/secrets/feranor-token").read().strip()

# partner: the base64 of the partner's certificate (DER)
with open("report.pdf", "rb") as content:
    answer = requests.post(f"{SIDECAR}/v1/encrypt?sign=true", data=content,
                           headers={"Authorization": f"Bearer {TOKEN}", "Feranor-Recipient": partner})
answer.raise_for_status()
open("report.pdf.p7m", "wb").write(answer.content)

From Java

With the JDK's HTTP client and no dependency, you decrypt a received message while requiring it to be signed, then read who signed it from the answer's headers.

HttpRequest request = HttpRequest.newBuilder(URI.create("http://feranor-sidecar:8080/v1/decrypt?requireSignature=true"))
    .header("Authorization", "Bearer " + token)
    .POST(HttpRequest.BodyPublishers.ofFile(Path.of("report.pdf.p7m")))
    .build();
HttpResponse<Path> response = client.send(request, HttpResponse.BodyHandlers.ofFile(Path.of("report.pdf")));
if (response.statusCode() != 200) { /* a problem (RFC 9457) with a stable code */ }
String signer = response.headers().firstValue("Feranor-Signer").orElseThrow();

Node and Go are written the same way, with fetch or net/http. Errors are problem details (RFC 9457) with a stable code, which your applications can handle once and for all.

What stays under your control

• Your infrastructure. The sidecar runs on your side, on premises or in your cloud, with no account and no connection to Feranor; it works on an isolated network.
• Your formats. Standard CMS messages and PKCS#8 keys, which lock you into nothing.
• Your pace. .NET applications can use the SDK in process, the others the sidecar, scripts and batches the fpqc command line, and all of them read and write the same messages.

The easiest cryptography to maintain is the one your applications do not have to carry.