@asentum/crypto

Post-quantum cryptography primitives for AsentumChain.

What's in here

• ML-DSA-65 (Dilithium3) signing and verification: the NIST-standardized post-quantum signature scheme. Wraps @noble/post-quantum/ml-dsa.
• BLAKE3 and SHA-256 hashing. BLAKE3 is the chain-wide canonical hash; SHA-256 is kept around for Ethereum-compatibility surfaces only. Wraps @noble/hashes.
• Address derivation: 20-byte addresses derived as BLAKE3(pubkey)[0:20] with an EIP-55-style mixed-case checksum.

Install

This package is part of the AsentumChain monorepo and is not yet published to npm. From the repo root:

pnpm install
pnpm --filter @asentum/crypto build
pnpm --filter @asentum/crypto test

Usage

import {
  generateKeypair,
  sign,
  verify,
  blake3,
  addressFromPublicKey,
} from '@asentum/crypto';

// Generate a keypair and derive an address
const { publicKey, secretKey } = generateKeypair();
const address = addressFromPublicKey(publicKey);
console.log('New account:', address);

// Sign a message
const message = new TextEncoder().encode('hello asentum');
const signature = sign(message, secretKey);

// Verify
const isValid = verify(message, signature, publicKey);
console.log('Signature valid?', isValid);

// Hash some data
const digest = blake3(message);

Design notes

• All inputs and outputs are Uint8Array. Hex/base58 encoding helpers live in @asentum/sdk, not here.
• verify() never throws on invalid input: it returns false. This makes it safe to call on untrusted data without wrapping in try/catch.
• Addresses are 0x-prefixed 40-character mixed-case hex strings. The case pattern encodes a checksum of the address bytes hashed with BLAKE3, matching EIP-55's mechanism but using our chain hash instead of Keccak256.

See docs/post-quantum.md in the repo root for the full reference on the cryptographic choices.

Status

Phase 0 scaffold, not yet benchmarked. The implementation is thin wrappers around well-audited upstream libraries, but we haven't measured it on the actual target hardware yet. Performance numbers (keygen / sign / verify on consumer PC vs Pi 4) will land in Phase 0's benchmarks task.

The exact import path for @noble/post-quantum/ml-dsa may need adjustment depending on the installed version: verify against the actual package when you first run pnpm install.

License

Apache License 2.0. See the root LICENSE file.