pqm1 0.1.0

Experimental post-quantum mnemonic payload format: BIP-39 24-word payloads with algorithm/version tags and SHAKE256 ML-DSA seed derivation. Unaudited.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

# PQM-1

> **Status: Wallet-recovery format. Not an audited key-management system.**
> This crate implements the deterministic mnemonic payload and seed derivation
> specified by PQM-1. It does not custody keys, manage passphrases, implement
> hardware-wallet flows, or define any chain's account/address format.

PQM-1 is a 24-word BIP-39-compatible mnemonic format for post-quantum signing
keys. It reuses the BIP-39 English wordlist and checksum machinery, but the
32-byte entropy payload is interpreted as:

```text
offset  length  field
0       1       algorithm tag: 0x01 = ML-DSA-65
1       1       version:       0x01 = PQM-1 v1
2       30      entropy:       240 bits
```

The payload is expanded into an ML-DSA-65 seed with SHAKE256:

```text
seed = SHAKE256(profile_domain || payload, 32)
```

The default Monolythium profile domain is:

```text
monolythium.pqm1.v1.mldsa65
```

Other chains can adopt the same PQM-1 payload shape while defining their own
profile domain and account/address derivation.

## What it is

- A self-describing 24-word phrase format for post-quantum wallet backup.
- A deterministic KDF from phrase payload to 32-byte ML-DSA-65 seed.
- A small bytes-oriented API with zero Monolythium chain types.
- A reference implementation with golden vectors.

## What it is not

- Not BIP-32 or BIP-44. PQM-1 v1 encodes one account per phrase.
- Not compatible with MetaMask-style BIP-39 -> secp256k1 mnemonics.
- Not a key vault or encrypted keystore.
- Not a chain address standard. Address derivation is intentionally profile-
  specific and lives above this crate.

## Minimal usage

```rust
use pqm1::{generate_mnemonic, Pqm1Payload, Pqm1Profile};

let mut rng = rand_core::OsRng;
let phrase = generate_mnemonic(&mut rng).unwrap();

let payload = Pqm1Payload::from_mnemonic(&phrase).unwrap();
let mono_seed = payload.derive_mldsa65_seed();

let near_profile = Pqm1Profile {
    mldsa65_domain_tag: b"near.pqm1.v1.mldsa65",
};
let near_seed = payload.derive_mldsa65_seed_with_profile(near_profile);

assert_ne!(&*mono_seed, &*near_seed);
```

## Interop rule

If a wallet sees a 24-word BIP-39 phrase whose first payload byte is not
`0x01`, or whose version byte is not `0x01`, it must reject explicitly. Silent
fallback to BIP-32/secp256k1 derivation is an address-loss footgun.

## License

Apache-2.0. See [LICENSE](./LICENSE).