Bonus 1: Post-Quantum Cryptography

🎯 Goal

Understand the threat posed by quantum computing to classical cryptographic algorithms, and get hands-on with emerging post-quantum cryptography (PQC) tools and implementations.

🧠 1. The Quantum Threat

📉 Problem

Quantum computers (with enough qubits) could:

• Break RSA, DSA, and DH using Shor’s algorithm
• Break elliptic-curve crypto (ECC) like Curve25519
• Render GPG, SSL/TLS, and Bitcoin signatures insecure

Most modern crypto is quantum-vulnerable

🕒 Timeline

🧬 2. NIST Post-Quantum Algorithms

As of 2024, NIST has selected finalists:

✅ Approved Algorithms

🔐 3. age + Post-Quantum Plugin

✨ age-plugin-pq by Filippo Valsorda

Combines Kyber (post-quantum KEM) + X25519 for hybrid encryption.

📦 Install age (if not already):

sudo apt install age

📦 Install age-plugin-pq:

mkdir -p ~/.config/age/plugins
cd ~/.config/age/plugins

# Download the prebuilt binary from:
# https://github.com/FiloSottile/age-plugin-pq/releases

chmod +x age-plugin-pq

Verify install:

age-plugin-pq --help

🔑 4. Generate Post-Quantum Key

age-plugin-pq keygen > pqkey.txt
grep "public key" pqkey.txt > pqkey.pub

Example public key:

# public key: pq-pub1...

📁 5. Encrypt & Decrypt with PQ

🔐 Encrypt

age -r pq-pub1abcdef... -o encrypted.txt.age plaintext.txt

🔓 Decrypt

age -d -i pqkey.txt -o plaintext.txt encrypted.txt.age

You are now encrypting with Kyber + X25519 hybrid encryption, secure against classical and quantum adversaries.

🛡 6. PQ-TLS (Experimental Browsing / Networking)

🚀 TLS Libraries with PQ Support

• liboqs + OpenSSL (quantum-safe ciphersuites)
• Chrome/Firefox (Cloudflare testnet)
• SSH PQ key types (OpenSSH 9.0+)

🧪 Try PQ in OpenSSH (if supported):

ssh-keygen -t x25519-sk # classical + PQ hybrids soon

Check for sntrup761x25519 support in:

ssh -vv user@host

💻 7. Try PQ Signing with openssl + liboqs

🧪 Install liboqs + oqs-openssl (if you’re on Linux)

Follow build instructions:
https://github.com/open-quantum-safe/oqs-openssl

You can then generate PQC certs:

./apps/openssl req -new -newkey dilithium3 -keyout pq.key -out pq.csr

Sign and test PQ certs (experimental).

🔗 8. PQ Resources & Projects

• 🔐 age-plugin-pq: https://github.com/FiloSottile/age-plugin-pq
• 🧬 liboqs: Open Quantum Safe project – https://openquantumsafe.org
• 🌐 PQ TLS test: https://pq.cloudflareresearch.com
• 📦 PQ GPG (experimental): https://github.com/open-quantum-safe/liboqs-pgp

📝 9. Journal & Git Commit

✍️ Reflect on PQCrypto

echo "Bonus 1: Learned about quantum threats to classical crypto. Used age-plugin-pq to encrypt files with Kyber hybrid encryption. Reviewed NIST PQ algorithms and explored experimental TLS + SSH tools." >> notes/bonus1_pqcrypto.md

📦 Git Commit

git add .
git commit -S -m "Bonus 1 – Post-Quantum Cryptography with Kyber and Dilithium"

✅ Bonus 1 Checklist

• Understood the threat of quantum computing to RSA/ECC
• Installed age-plugin-pq and generated PQ keys
• Encrypted/decrypted files with Kyber+X25519
• Explored PQTLS and PQSSH concepts
• Wrote journal entry and committed code

🧭 Up Next Bonus Suggestions

• Bonus 2: Self-Sovereign Identity (DIDs + Verifiable Credentials)
• Bonus 3: Metadata-Resistant Messaging (Nym, Loopix, Sphinx)
• Bonus 4: Zero-Knowledge Proofs & zkSnarks
• Bonus 5: Privacy-Focused Smart Contracts

📌 Notes

• Post-quantum readiness is a moving target — monitor NIST, OQS, and browser announcements
• Hybrid crypto (classical + PQ) is currently the best of both worlds
• age-plugin-pq is a secure and elegant way to get hands-on with PQC today