Crate origin_crypto_sdk 

Origin Crypto SDK — Post-quantum and classical cryptographic primitives.

A standalone Rust SDK for signing, encryption, key derivation, and key encapsulation, with first-class support for both classical (Ed25519, X25519) and post-quantum (Falcon-1024, SLH-DSA, ML-DSA, NTRU Prime, Curve41417) primitives.

Quick start

For most users, importing the prelude gives you everything:

use origin_crypto_sdk::prelude::*;

// Hybrid Ed25519 + Falcon-1024 signature (recommended default)
let master_seed = [0x42u8; 32];
let bundle = HybridSigningKeyBundle::from_seed(&master_seed, "my-app")
    .expect("valid seed");
let msg = b"sign this";
let sig = bundle.sign_hybrid(msg);
// sig is an Ed25519 + Falcon-1024 hybrid signature

For users who only need a single primitive:

use origin_crypto_sdk::signing::classical::Ed25519Signer;
use origin_crypto_sdk::signing::postquantum::Falcon1024Signer;

// Just Ed25519
let ed = Ed25519Signer::from_seed(&[1u8; 32]);
let sig = ed.sign(b"hello");
assert!(ed.verify(b"hello", &sig));

// Just Falcon-1024
let falcon = Falcon1024Signer::from_seed(&[1u8; 32]);
let sig = falcon.sign(b"hello").expect("Falcon sign");
assert!(falcon.verify(b"hello", &sig));

Module organization

• signing — Direct access to signing primitives, organized by family:
  • signing::classical — Ed25519 (no PQ dependencies)
  • signing::postquantum — Falcon-512/1024, SLH-DSA, ML-DSA
  • signing::hybrid — Recommended default. Ed25519 + PQ combined.
• aead / chacha20_blake3 — Symmetric encryption (committing & non-committing)
• kdf — Key derivation (Argon2id, HKDF-SHA3-256)
• pqc — Raw post-quantum primitives (advanced use)
• ec_schnorr — secp256k1 Schnorr signatures (native, no external deps)
• prelude — One-line import for common types

Security defaults

• For signatures: use the hybrid (Ed25519 + PQ) — see signing::hybrid. Both must verify, so a vulnerability in one primitive does not break security.
• For encryption: prefer chacha20_blake3 (committing AEAD). Avoid XChaCha20-Poly1305 unless you specifically need the smaller tag and accept the partitioning-oracle risk.
• For key derivation: use Argon2id (memory-hard) for password-based KDF, HKDF-SHA3-256 for HKDF-style derivation.

Cargo features

Feature	Enables	Default
parallel	Rayon-based parallel processing	yes
slh-dsa	SLH-DSA / SPHINCS+ signatures (FIPS 205)	no
ml-dsa	ML-DSA / Dilithium signatures (FIPS 204)	no
pqc-simd	SIMD acceleration for NTRU Prime	no

Low-level PQC primitives are always available through their modules (pqc::falcon1024, pqc::ed448, etc.) — the features only gate the optional FIPS schemes that pull in extra dependencies.

Re-exports

pub use error::CryptoError;

pub use error::Result;

pub use error::CryptoError as Error;

pub use error::Result as StdResult;

pub use aead::XChaCha20Poly1305;

pub use kdf::hkdf::derive_subkeys;

pub use kdf::hkdf::hkdf_sha3_256;

pub use kdf::Argon2id;

pub use kdf::mac::hmac_sha3_256;

pub use drbg::ChaCha20Drbg;

pub use seed::derive_child_seed;

pub use seed::derive_signing_keys;

pub use seed::derive_verifying_keys;

pub use seed::SeedHandle;

pub use signing::HybridSignatureOutput;Deprecated

pub use signing::HybridSigningKey;Deprecated

pub use signing::HybridVerifyingKey;Deprecated

pub use signing::hybrid::falcon1024_keygen;

pub use signing::hybrid::HybridSigningKeyBundle;

pub use signing::hybrid::skein1024;

pub use signing::hybrid::skein512;

pub use pqc::slhdsa::sign as slhdsa_sign;

pub use pqc::slhdsa::verify as slhdsa_verify;

pub use pqc::slhdsa::SlhDsaPrivateKey;

pub use pqc::slhdsa::SlhDsaPublicKey;

pub use pqc::mldsa::MldsaPrivateKey;

pub use pqc::mldsa::MldsaPublicKey;

Modules

aead

Authenticated Encryption with Associated Data (AEAD)

chacha20_blake3

ChaCha20-BLAKE3 AEAD cipher

drbg

ChaCha20-DRBG — deterministic CSPRNG with auto-reseed.

ec_schnorr

EC-Schnorr proof system over secp256k1 (k256 crate).

error

Unified error type for cryptographic operations.

kdf

Key Derivation Functions

pqc

Post-quantum and high-security classical cryptography module for Origin SDK.

prelude

Prelude — re-exports common types for use origin_crypto_sdk::prelude::*. Prelude — re-exports the most commonly used types.

recovery

BIP-39-shaped Unicode recovery phrases. NOT BIP-39-compatible — uses a curated Unicode codepoint wordlist and SHA-3-256 (not SHA-256). For interop with other wallets, use the bip39 crate. Recovery primitives.

seed

Seed handling with TTL and memory security. Seed handle with time-to-live and memory security.

signing

Signing primitives: classical, post-quantum, and hybrid.

signing_legacyDeprecated

DEPRECATED: Pre-0.4 flat signing API. Use signing::hybrid, signing::classical, and signing::postquantum instead.

stealth

Stealth address primitives (KDF + PoW). Stealth address primitives.

test_utils

Test utilities for downstream users.

types

Error types and Result alias. Typed wrappers for cryptographic primitives.