[GoDeskio]

Backlog #6, post-quantum readiness.

• src/pq.rs: wraps a DEK to a hybrid public key.
• KEK = HKDF over both shared secrets, plus the ephemeral key, the recipient key and the KEM ciphertext. Payload sealed with XChaCha20-Poly1305 under the EGPQ v1 format.
• Rejects non-contributory X25519 results.
• Uses RustCrypto ml-kem 0.2 (FIPS 203, Apache/MIT) and x25519-dalek 2. Note that ml-kem has not had an independent audit.
• lib.rs: three key.as_ref().into() calls became (&*key).into() to fix a type-inference break caused by the new dependency. No behaviour change.
• Tests: round trip, randomized output, tamper at four offsets, wrong key, bad public key length.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​ml-kem@​0.2.3
	cargo/​x25519-dalek@​2.0.1

View full report