Release Notes: PQPG v1.0.0

• Pre-built liboqs module for linux-amd64 is added but changing the path to the artifact is still required for internal/oqs/oqs.go and internal/oqs/cfuncs.go
• Pre-built pqpg-linux-amd64 is also added which supports all of the available engines

Release Notes: PQPG v1.0.0

This release marks the most significant architectural expansion in the history of the Post-Quantum Privacy Guard (PQPG). We have successfully bridged three distinct cryptographic universes—Cloudflare's circl (Pure Go), Katzenpost's hpqc (Assembly/CGO), and the Open Quantum Safe liboqs project (Static C-FFI)—under a single, unified SOLID routing layer.

PQPG is no longer just a Privacy Guard; it is a mathematically absolute, 240-suite hybrid post-quantum testing ground and deployment engine.

Major Features

• The Hardware-Accelerated OQS Extension Engine:
  Introduced a dedicated, statically-linked liboqs C-FFI pipeline exclusively for Linux/AMD64. This unlocks an entirely new 120-suite hardware-accelerated profiler featuring experimental and bleeding-edge algorithms.
• Multivariate & MPC-in-the-Head Primitives:
  Natively integrated advanced computational signature schemes including MAYO, Oil and Vinegar (OV), SNOVA, MQOM2, and CROSS.
• Advanced Code-Based & Extended Lattices:
  Full support for BIKE (L1/L3/L5), extended parameter sets for FrodoKEM/eFrodo, and the complete NTRU family (HPS/HRSS).
• Extreme Pre-Hashed SPHINCS+:
  Added hardcore SLH-DSA variants utilizing Pre-Hashed SHA2 and SHAKE constructs, engineered specifically for failsafe software release engineering and massive payload signing.
• The Universal Namespace Router (crypto.Registry):
  The dynamic registry now intelligently parses explicit URI-style namespaces. Requests prefixed with Hpqc- route to Katzenpost adapters, Oqs- route to the C-FFI wrappers, and everything else defaults to CIRCL.
• The Unified Adapter Handlers:
  A massive triumph in DRY (Don't Repeat Yourself) design. The OQS, HPQC, and CIRCL engines all funnel through the exact same network, vault, and stateless messaging handlers. The core state machine is completely blind to whether it is executing C code, Go assembly, or pure Go math.

Security & Memory Hygiene Enhancements

• Strict CGO Memory Escaping: The oqs-adapter.go was engineered with critical memory boundaries. Private keys generated inside the C-allocated structs are safely copied into Go-managed memory slices before liboqs executes OQS_MEM_cleanse, ensuring zero memory leaks while surviving the Garbage Collector.
• Separation of Capabilities: The UI has been heavily sanitized. Zero-Knowledge Proofs (ZKP, Groth16, VDF) and Shared Vaults (Feldman VSS) remain safely sandboxed inside the Core Engine, while the OQS Extension Engine provides a streamlined, dedicated path for stateless messaging, vaults, and detached signatures.
• 64-Byte Combiner Entropy: The SHA3-512 KEM blending layer now perfectly passes 512 bits of pure entropy straight to the wide-block symmetric suite, maximizing the security margins for Threefish-1024 and Skein-1024.

Deprecations & Removals

• Removed all fallback/stub files for OQS. The liboqs engine is now strictly enforced as an opt-in runtime path for supported Linux/AMD64 environments.
• Deprecated hardcoded hybrid nomenclature (e.g., X-Wing) in the UI, enforcing the dynamic Hybrid- combiner syntax uniformly across the codebase.

Massive Changes inside the SUITS and adding HPQC

This is a monumental release for the Post-Quantum Privacy Guard (PQPG). We have successfully completed a total overhaul of the cryptographic routing layer, effectively transforming PQPG into a mathematically absolute, 120-suite Hybrid Post-Quantum engine.

By strictly adhering to SOLID software engineering principles, these massive upgrades were implemented entirely within the Adapter and Registry layers. The core Double Ratchet, Stateful Vaults, and Sealed Sender network protocols required zero structural modifications and remain 100% backward compatible.

Major Features

• The 120-Suite Universal Hybrid Engine: We have enforced a strict "Hybrid-Only" rule across all 120 identity configurations. The engine guarantees that every single cryptographic operation is mathematically backed by at least one classical baseline curve (X25519, X448, Ed25519, Ed448).
• Native Katzenpost HPQC Integration: Natively imports highly optimized CGO/Assembly implementations of Code-based (McEliece, HQC) and NTRU-lattice (SNTRUP) algorithms.
• The Dynamic Cryptographic Combiner: The engine can now dynamically pair any Post-Quantum algorithm from any library with a classical ECC curve on the fly. KEM combinations are securely blended using a SHA3-512 KDF, while DSA combinations generate independent, concatenated dual-proofs.
• Cross-Library Paranoia Composites:
  Introduced extreme cross-library suites (e.g., Code-Based McEliece-8192 from hpqc paired with Lattice-Based Dilithium5 from circl). This defends against both algorithmic breakthroughs and single-library supply chain attacks.
• Intelligent Namespace Routing:
  The new crypto.Registry seamlessly parses explicit URI-style namespaces (Hpqc- vs Hybrid-), instantly resolving the dependency collision between Katzenpost's native hybrids and our custom PQPG dynamic wrappers.

Security Enhancements & Entropy Fixes

• 64-Byte Entropy Expansion: The stateless.go extraction layer was upgraded. The SHA3-512 master cryptographic combiner now safely passes 64 bytes (512 bits) of pure entropy directly into the stream ratchets. This guarantees maximum security margins for massive wide-block ciphers like Threefish-1024 and fully supports the massive entropy generated by McEliece8192128.
• Stateful Signature Isolation: FIPS-205 Stateful signatures (LMS/XMSS) remain completely air-gapped from the dynamic hybrid layer. The anti-rollback hardware-safe atomic swaps continue to operate with extreme rigidity.
• Scorched Earth Dependency Localization:
  To permanently protect PQPG from the "Transitive Dependency Hell" caused by vanishing upstream repositories (git.xx.network), all upstream HPQC primitives have been localized and hard-forked into the internal/ directory.

Deprecations & Removals

• The hardcoded "X-Wing" nomenclature has been fully deprecated in the identity router in favor of the standardized dynamic identifier (Hybrid-ML-KEM-768+X25519). (Note: The underlying standard IETF draft-connolly-cfrg-xwing-kem implementation via CIRCL remains natively supported).
• Removed broken upstream dependency references to katzenpost/circl to prevent compile-time interface panics.

PQPG Architecture Update: The OpenPGP v6 Compatibility Engine

This major release introduces full, interoperable Post-Quantum OpenPGP support. By integrating ProtonMail's highly audited gopenpgp (v3) library, PQPG can now communicate securely with the outside world using standardized IETF post-quantum drafts, without compromising the integrity or algorithmic purity of the native Double Ratchet ecosystem.

Architectural Highlights

• The Air-Gapped OpenPGP Compartment: The OpenPGP engine operates in strict isolation (Option 3 in the main menu). It utilizes its own dedicated keystore logic, ensuring that standardized Web of Trust operations never bleed into or pollute the bespoke Double Ratchet and Vault state machines.
• IETF Post-Quantum Draft Compliance: Fully implements draft-ietf-openpgp-pqc-09. The engine natively handles RFC 9580 v6 packets, RFC 3394 AES Key Wrap, and the strict KMAC256 Key Derivation Functions mandated for composite post-quantum routing.
• Dynamic UX & Keystore Management: Key generation dynamically provisions isolated, user-specific directory structures (e.g., Alice_Smith_openpgp_keys) to cleanly manage multiple identities and prevent path-collision errors.

New Cryptographic Primitives & Pairings

The engine introduces the Proton/PQC cryptographic profile, automatically mapping FIPS-standardized algorithms to their traditional ECC fallbacks to maintain absolute crypto-agility and backwards compatibility:

• Composite Key Encapsulation (KEM): * Standard: Kyber768 + X25519 (Algorithm ID 29)

• High Security: Kyber1024 + X448 (Algorithm ID 30)

• Composite Signatures (DSA):

• Standard: ML-DSA-65 (Dilithium3) + Ed25519 (Algorithm ID 35)

• High Security: ML-DSA-87 (Dilithium5) + Ed448 (Algorithm ID 36)

• Symmetric & Key Protection: Enforces AES-256-GCM for packet encryption and Argon2id for robust, brute-force-resistant private key password protection (S2K).

Supported Interoperable Operations

Users operating within the OpenPGP compartment can now execute the following standardized workflows:

• Asynchronous File Streaming: Encrypt and sign massive files or decrypt and verify incoming .pgp streams natively.
• Cleartext Signed Messages: Generate and mathematically verify PGP messages where the plaintext payload remains human-readable.
• Detached Signatures: Output standalone .sig artifacts for highly secure, post-quantum software release engineering and verification.
• Keyblock Distribution: Export and import fully compliant .asc armored composite keyblocks for integration with modern, PQC-aware mail clients.

Critical Bug Fixes & Refinements

• Stateless File Targeting: Patched a fatal nil-pointer vulnerability in the interactive CLI handlers where directory paths were incorrectly passed directly to the gopenpgp byte-reader, resulting in zero-entity panics. Explicit file-path validation and os.ReadFile error handling have been strictly enforced across all OpenPGP operations.

Architecture Update: The Pure Skein & Wide-Block Expansion

This release focuses entirely on establishing an ultra-conservative, quantum-resistant symmetric foundation by integrating the Threefish tweakable block cipher and the Skein hash function family natively into the PQPG engine.

New Cryptographic Primitives

• Threefish-EtM Integration: Added support for Threefish-256, Threefish-512, and the massive Threefish-1024 block ciphers. These are deployed using a native Encrypt-then-MAC (EtM) wrapper to ensure full authenticated encryption over immensely wide blocks.
• Skein Hash Family: Integrated Skein-256, Skein-512, and Skein-1024. Operating in Unique Block Iteration (UBI) chaining mode, Skein serves natively as both the XOF and Key Derivation Function across the core protocols.
• "Pure Skein" Identity Profiles: Added dedicated identity suites (Options 68–70) that seamlessly pair the Threefish cipher with its corresponding Skein hash size, creating a unified mathematical core that drastically reduces the application's attack surface against future classical cryptanalysis and Grover's algorithm.

Critical Security & Vulnerability Patches

• Dynamic Key Sizing Validation: Patched a silent failure vulnerability where orchestrators implicitly hardcoded 32-byte key boundaries, causing massive wide-block algorithms (like Threefish-1024, which requires 160 bytes for an EtM profile) to silently fail open and generate ghost files. aead.KeySize() bounds are now strictly and dynamically enforced across the network, vault, and time-lock protocols.
• Zero-Padding Entropy Stretch Fixed: Fixed an architectural flaw in the fixed-hash adapters (SHA-2/SHA-3) where deriving keys larger than the native digest size resulted in zero-padded tail bytes. The engine now automatically routes oversized requests through a SHAKE256 entropy sponge to guarantee full cryptographic saturation.
• Goroutine Deadlock Prevented: Resolved a critical resource exhaustion vector where corrupt or truncated payload chunks would throw an error during decompression, permanently blocking the io.Pipe() writer goroutine and risking an Out-Of-Memory (OOM) kernel panic. Pipe closures are now explicitly deferred in the orchestrator bounds.
• Timing Side-Channel Mitigated: Replaced native bytes.Equal logic with subtle.ConstantTimeCompare across the entire Double Ratchet key-hint routing schema, preventing eavesdroppers from statistically analyzing rejection times to profile local identity databases.
• Memory Hygiene Enforced: Added a deterministic crypto.Wipe() utility to enforce the immediate, mathematically guaranteed shredding of shared secrets, derived keys, and header authenticators from local RAM after execution.
• CTR Keystream Overlap Eliminated: Re-engineered the buildChunkNonce function for all EtM wrappers. Chunk counters are now XOR'd into the Most Significant Bytes (MSB) of the nonce array, completely preventing mathematical overlap with the underlying Counter Mode (CTR) incrementer.

PQPG - Symmetric Architecture Upgrade

Type: Major Feature & Security Upgrade

This release massively expands the symmetric cryptographic suite of the Post-Quantum Privacy Guard (PQPG). Moving beyond standard 12-byte nonce limitations, this update introduces Cryptographic Pluralism by integrating 24-byte extended nonces and CAESAR-winning Misuse-Resistant Authenticated Encryption (MRAE) architectures to mathematically eliminate collision risks on massive datasets.

[+] Added (New Cryptographic Primitives)

• XAES-256-GCM: Integrated a native Go implementation utilizing an SP800-108r1 KDF. Extends the AES-GCM nonce to 24 bytes, combining hardware-accelerated speeds with immunity to birthday-bound collisions.
• XChaCha20-Poly1305: Activated the extended 24-byte nonce variant of ChaCha20, enabling perfectly safe, randomized stream encryption for asynchronous messaging without counter-management overhead.
• AES-GCM-SIV (RFC 8452): Integrated pure-Go, cross-platform Synthetic Initialization Vector (SIV) architecture. Provides absolute nonce-misuse resistance; a repeated nonce degrades gracefully to deterministic encryption without leaking the authentication key.
• AES-SIV-CMAC: Added deterministic, ASM-accelerated SIV functionality (via secure-io) utilizing a 64-byte dual-key setup. Ideal for deduping local static vaults and blind-indexing local BoltDB structures.
• Deoxys-II-256-128: Integrated the CAESAR competition winner for "Defense in Depth" (via Oasis Protocol). Provides a native 15-byte nonce and ultimate MRAE protection against catastrophic OS-level entropy failures.

[+] Added (Features & Tooling)

• 16 New High-Assurance Profiles: Expanded the CLI identity generator (identity-handlers.go) with Options 40 through 55, allowing users to explicitly bind their Post-Quantum KEMs (ML-KEM, FrodoKEM) to Extended Nonce or Misuse-Resistant symmetric ciphers.
• Stateful MRAE Bounding: Added dedicated identity profiles linking FIPS 205 Stateful Signatures (XMSS) directly with Deoxys-II for ultra-secure release engineering.

[~] Changed & Refactored

• Symmetric Factory (sym-adapters.go): Completely refactored the AEAD interface registry to dynamically route between 12-byte, 15-byte, 16-byte, and 24-byte nonce sizes. This allows the core stream.go and vault.go orchestrators to auto-adjust their random initializations without breaking legacy standard profiles.
• Dual-Track SIV Architecture: Segregated SIV logic into aesgcmsiv-noasm (for RFC-compliant, cross-platform portability) and aesgcmsiv-asm (for hardware-accelerated deterministic operations) to ensure flawless cross-compilation across Android, Windows, macOS, and Linux targets.

Integrating liboqs(Open-Quantum Safe Library) and Archiver

Added

• Intelligent Directory Archiving (archive.go): The engine now natively detects directory inputs and automatically bundles them into maximum-compression .tar.gz archives in-memory before passing them to the cryptographic stream processors.
• Native Open Quantum Safe (liboqs) Engine: Fused the Open-Quantum Safe C library directly into the Go binary via static linkage (liboqs.a)
• Subsystem Architecture Routing (main.go): Implemented a top-level OS-aware gate using runtime.GOOS. The application now safely routes users between the cross-platform Core Crypto Engine and the OQS Extension Engine (currently locked to Linux natives to prevent cross-compilation panics).
• C-FFI Diagnostic Tool: Added Option 98 to the system menu, allowing developers to query the C-FFI bridge at runtime to verify liboqs versioning and the matrix of enabled algorithms.

Changed

• Hardcoded CGO Directives: Bypassed the unpredictable pkg-config system. Rewrote internal/oqs/oqs.go and cfuncs.go to explicitly target absolute CFLAGS and LDFLAGS, guaranteeing a mathematically isolated static build.
• Unified Input Interception: Refactored handleSend, handleStatelessSend, handleVaultLock, handleSharedVaultLock, and handleTimeLockSeal to pipe all user file inputs through the newly built resolveInputPath wrapper.

PQPG Architecture Update: The "Phantom Workspace"

With this architectural overhaul, PQPG fundamentally neutralizes "Evil Maid" attacks, cold-boot memory dumps, and physical forensic SSD extraction. By bridging Golang's native streaming capabilities with OS-level memory isolation, we have successfully decoupled the Cryptographic Control Plane (your private keys and state) from the Data Plane (your files).

All identity-linked cryptographic operations now execute entirely within a zero-trace, ephemeral RAM-disk.

Core Security Upgrades

• Zero-Trace Execution Pipeline (/dev/shm): At launch, PQPG now dynamically mounts an invisible, strictly-permissioned (0700) Phantom Workspace in volatile RAM. Master keys, Address Books, and Double Ratchet databases are decrypted directly into this hardware-backed memory layer. If the machine loses power, the kernel panics, or the CLI process is killed, the RAM clears instantly. Zero physical trace survives on the SSD flash chips.
• Atomic State Rollbacks: The Double Ratchet state engine (sessions.db) now updates exclusively inside the RAM-disk during packet decryption. If a message is malformed, fails the AES-GCM MAC check, or attempts a replay attack, the RAM-disk is violently shredded and the persistent SSD database remains completely untouched, preventing state corruption.
• Hardware-Style Anti-Rollback Guards: Stateful Hash-Based Signatures (LMS/XMSS) now load their mathematical sequence counters and canary.bin tracking files into the Phantom Workspace. The OS kernel enforces synchronized state progression in RAM, safely writing back to the SSD only upon a flawless, verified signature generation.
• Air-Gapped Identity Generation: The identity.GenerateIdentity engine now boots inside the Phantom Workspace. Unencrypted Post-Quantum lattice keys and Hash-Based signature parameters are generated and mathematically bound strictly in volatile memory before being sealed via Argon2id/AES-GCM and safely extracted to the persistent disk.

Under the Hood (Developer Notes)

• New Package Integration: Introduced internal/phantom, providing the Workspace and Bridge logic. The bridge handles the bit-by-bit secure copy (I/O) of the encrypted AES-GCM vault from the persistent disk into the RAM mount.
• Cross-Platform Graceful Fallback: While natively targeting Linux /dev/shm for hardware-level volatility without requiring sudo privileges, the engine gracefully falls back to strict OS-level temporary directories on macOS and Windows.
• Identity-Less Protocol Bypass: Asynchronous Time-Lock Puzzles (VDFs) and Steganographic engines inherently avoid the Phantom pipeline, as their mathematical operations are strictly stateless and process without mutating the user's identity directory.

Release v0.1.0: Welcome to the Post-Quantum Era

We are thrilled to announce the initial release (v0.1.0) of PQPG (Post-Quantum Privacy Guard).

This release marks the first public milestone of our prototype. PQPG is engineered to be a next-generation cryptographic toolkit, designed to protect highly sensitive data against both contemporary and future quantum-computing threats. By combining Cloudflare's circl library with a robust zero-knowledge engine, PQPG redefines file encryption, metadata privacy, and digital signatures.

Key Features in this Initial Release

• Hybrid Post-Quantum Cryptography (PQC): Native support for the latest NIST standards (FIPS 203, 204, and 205) alongside hybrid composite algorithms like X-Wing (X25519 + ML-KEM-768) and EdDilithium to ensure crypto-agility.
• Post-Quantum Double Ratchet Engine: Implements Perfect Forward Secrecy (PFS). Every message is encrypted with a unique, one-time key, ensuring historical communications remain secure even if current keys are compromised.
• Sealed Sender & Metadata Anonymity: Employs Dual-Layer envelopes and 32-byte Keccak Key Hints to completely blind the routing, masking both the sender and receiver from network eavesdroppers.
• Zero-Knowledge Data Notary (Proof of Breach): Prove the possession of large datasets using Groth16 zk-SNARKs (BN254 curve) without revealing a single byte of the actual file.
• Trustless Distributed Vaults: Distribute files across multiple stakeholders using Feldman’s Verifiable Secret Sharing (VSS) over the Ed25519 scalar field.
• Zero-Knowledge Time-Lock Puzzles: Encapsulate files inside an RSA-4096 Hidden Order Group, mathematically enforcing sequential CPU delays before decryption is possible.

Getting Started

You can compile the PQPG CLI directly from the source. Ensure you have Go 1.25.10+ installed:

git clone https://github.com/gh4rib/pqpg.git
cd pqpg
go mod tidy
go mod vendor (optional)
CGO_ENABLED=1 go build -o pqpg ./cmd/messenger
./pqpg

Security Disclaimer & Status

Prototype Status: This is an initial v0.1.0 prototype. While it implements state-of-the-art cryptographic primitives, the codebase has not yet been audited by independent security professionals. Please use this tool for research, testing, and educational purposes. Do not use in production or for life-critical sensitive data at this stage.

Call for Feedback and Contributions

As an open-source initiative, community feedback is vital. We invite security researchers, cryptographers, and Go developers to review the architecture, test the tool, and submit feedback.

• Found a bug? [Open an Issue](https://www.google.com/search?q=https://github.com/gh4rib/pqpg/issues).
• Want to contribute? Pull Requests are highly welcome.
• If you find this project interesting, please consider giving it a ⭐️ on GitHub!