quantum-box 0.1.0

Reference implementation of an anonymous sealed box with a post-quantum hybrid KEM (ML-KEM + X25519)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163

name: CI

# Unless we are on the main branch, stop and yield to a new run if new code is pushed.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.sha || github.ref }}
  cancel-in-progress: ${{ github.ref != 'main' }}

on:
  push:
    branches: [main]
  pull_request:

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read

jobs:
  lint:
    name: Format, Clippy & Build
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (https://github.com/actions/checkout/releases/tag/v6.0.2)
        with:
          persist-credentials: false

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch HEAD as of 2026-05-20 (https://github.com/dtolnay/rust-toolchain/tree/stable)
        with:
          toolchain: stable
          components: clippy,rustfmt

      - name: Check code formatting
        run: cargo fmt -- --check

      - name: Run clippy
        run: cargo clippy

  test:
    name: Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read

    strategy:
      matrix:
        rust:
          - stable
          - nightly
          - 1.85.0 # MSRV

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (https://github.com/actions/checkout/releases/tag/v6.0.2)
        with:
          persist-credentials: false

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch HEAD as of 2026-05-20 (https://github.com/dtolnay/rust-toolchain/tree/stable)
        with:
          toolchain: ${{ matrix.rust }}

      - name: Run tests
        run: |
          cargo test

      - name: Build non-default features
        run: |
          cargo build

  cross:
    name: Cross-compile (${{ matrix.target }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: wasm32-unknown-unknown
            os: ubuntu-latest
            feature_flags: 'wasm_js'
          - target: aarch64-apple-ios
            os: macos-latest
          - target: aarch64-linux-android
            os: ubuntu-latest
          - target: armv7-linux-androideabi
            os: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (https://github.com/actions/checkout/releases/tag/v6.0.2)
        with:
          persist-credentials: false

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch HEAD as of 2026-05-20 (https://github.com/dtolnay/rust-toolchain/tree/stable)
        with:
          toolchain: stable
          targets: ${{ matrix.target }}

      - name: Build
        run: cargo build --lib --target ${{ matrix.target }} ${{ matrix.feature_flags && format('--features "{0}"', matrix.feature_flags) || '' }}

  deny:
    name: Cargo deny
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      matrix:
        checks:
          - advisories
          - bans licenses sources

    continue-on-error: ${{ matrix.checks == 'advisories' }}

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (https://github.com/actions/checkout/releases/tag/v6.0.2)
        with:
          persist-credentials: false

      - uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2.0.18 (https://github.com/EmbarkStudios/cargo-deny-action/releases/tag/v2.0.18)
        with:
          command: check ${{ matrix.checks }}
          rust-version: 1.94

  fuzz:
    name: Fuzz
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (https://github.com/actions/checkout/releases/tag/v6.0.2)
        with:
          persist-credentials: false

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch HEAD as of 2026-05-20 (https://github.com/dtolnay/rust-toolchain/tree/stable)
        with:
          toolchain: nightly

      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz --locked --version 0.13.2

      - name: Build fuzz targets
        run: cargo fuzz build

      # A short campaign per target guards against regressions
      - name: Smoke-run fuzz targets
        run: |
          cargo fuzz run unseal -- -dict=fuzz/holocron.dict -max_total_time=30
          cargo fuzz run public_key -- -max_total_time=30
          cargo fuzz run roundtrip -- -max_total_time=30