pqpg

pqpg (Post-Quantum Privacy Guard) is a modern, universal, and standalone command-line interface (CLI) for robust file encryption, digital signatures, and key management, built entirely in pure Rust. This tool features hybrid post-quantum encryption, ensuring a high level of security and privacy with native support for air-gapped QR code data transfer, right from the terminal.

Key Features

• Memory Safety: Utilizes Rust's capabilities to eliminate vulnerabilities such as buffer overflows and use-after-free errors, along with deterministic zeroing of secrets in volatile memory and protection against disk paging.
• Zero External Dependencies: No need for complex libraries like OpenSSL or glibc. Cryptographic primitives including ML-KEM-768, X25519, ChaCha20-Poly1305, and Ed25519 are all implemented natively in Rust.
• Portability: Generates a single static binary (just 1.2 MB) that can be compiled for any Linux, macOS (Apple Silicon/Intel), and Windows environment.

Cryptographic Algorithms

• KEM (Key Encapsulation Mechanism): Utilizes NIST FIPS 203 ML-KEM-768 with specified lengths for public keys, ciphertexts, and secret keys.
• Hybrid Diffie-Hellman: Incorporates ephemeral X25519 to ensure Perfect Forward Secrecy (PFS) for secure key exchanges.
• Authenticated Encryption: Uses ChaCha20-Poly1305 with a 256-bit key derived via HKDF-SHA256 for symmetric encryption.
• Digital Signatures: Implements Ed25519 for creating 64-byte detached signatures.
• Message Formats: Supports both armored ASCII format (-----BEGIN PQPG ...-----) and compact binary formats for ease of use.

Usage Scenarios

Key Generation

# Generate identity.key (0600) and identity.pub
pqpg keygen -n identity

# Generate QR Code for air-gapped systems
pqpg keygen -n identity --qr

File and Stream Encryption

# Encrypt a file for a specific recipient
pqpg encrypt -r alice.pub segreto.txt -o segreto.msg

# Encrypt from stdin, displaying a QR code
echo "Messaggio riservato" | pqpg encrypt -r alice.pub --qr

Decryption

# Decrypt a message using the private key
pqpg decrypt -s identity.key segreto.msg

# Decrypt from pipe
cat segreto.msg | pqpg decrypt -s identity.key

Signing and Verification

# Sign a document
pqpg sign -s identity.key documento.pdf -o documento.sig

# Sign with QR Code display
pqpg sign -s identity.key documento.pdf --qr

# Verify the signature
pqpg verify -k alice.pub -s documento.sig documento.pdf

QR Code Display

# Display a QR code for any key or message
pqpg qr chiave_o_messaggio.txt

pqpg provides a secure and efficient solution for file encryption and key management, paving the way towards enhanced post-quantum security.