Why Your Secret Sharing Tool Needs Post-Quantum Cryptography Today

Source: Dev.to

The “Harvest Now, Decrypt Later” Threat

Quantum computers capable of breaking RSA and ECC encryption don’t exist yet, but adversaries are already collecting encrypted data today and planning to decrypt it once quantum computers arrive. For sensitive data that needs to remain confidential for years, this is a real threat.

Post‑quantum cryptography (PQC) uses mathematical problems that are hard for both classical and quantum computers to solve. In August 2024, NIST standardized three PQC algorithms:

• ML‑KEM (Kyber) – Key encapsulation
• ML‑DSA (Dilithium) – Digital signatures
• SLH‑DSA (SPHINCS+) – Hash‑based signatures

Implementing PQC in NoTrust.now

I recently added PQC support to NoTrust.now, a zero‑knowledge secret sharing tool.

// Using crystals-kyber-js library
import { MlKem768 } from 'crystals-kyber-js';

// Receiver generates keypair
const [publicKey, privateKey] = await MlKem768.generateKeyPair();

// Sender encapsulates a shared secret
const [ciphertext, sharedSecret] = await MlKem768.encapsulate(publicKey);

// Receiver decapsulates to get the same shared secret
const decryptedSecret = await MlKem768.decapsulate(ciphertext, privateKey);

Defense in Depth: Combining PQC with Classical Crypto

1. Generate an ephemeral X25519 keypair (classical).
2. Generate an ephemeral ML‑KEM‑768 keypair (post‑quantum).
3. Combine both shared secrets:

const finalKey = HKDF(x25519Secret || kyberSecret);

This approach ensures security even if one algorithm is compromised.

Try It Yourself

You can test PQC secret sharing at NoTrust.now/createpqc. The encryption happens entirely in your browser—thanks to the zero‑knowledge architecture, the server never sees your plaintext.

NIST PQC Standards & Resources

• crystals-kyber-js – JavaScript implementation of Kyber.
• Post‑Quantum Cryptography for Developers – Guidance and best practices for integrating PQC into applications.

Discussion

What do you think about PQC adoption? Too early, or just in time? Share your thoughts in the comments.