@maatara/pqc-toolkit

Low-level Rust/WASM cryptographic primitives for Ma'atara: ML-DSA-65, ML-KEM-768, SHA3-384, AES-256-GCM, provenance helpers, and the canonical Ma'atara pairwise channel.

Product code should use @maatara/secure-channel as its orchestration boundary. Direct toolkit use is intended for platform adapters, conformance tests, and audited protocol integrations.

The pairwise-channel V1 implementation is experimental and production-disabled. Publishing this package does not establish an independent audit, a production secure-messaging claim, or product activation.

Pairwise channel v1

Import the canonical TypeScript API from @maatara/pqc-toolkit/pairwise-channel:

import { MaataraPairwiseChannel, MaataraPairwiseIdentity } from '@maatara/pqc-toolkit/pairwise-channel';

The only pairwise bootstrap profile is maatara.pqxdh-kem.v1. It requires a canonical, context-bound handshake, ML-KEM-768 identity and signed-prekey encapsulations, an exact mandatory one-time prekey, ML-DSA-65 authentication, and sealed identity and channel state.

State-changing operations are failure-atomic. Each successful mutation advances the sealed-state generation and requires the old and new canonical state AAD. Message encryption and decryption require non-empty transport AAD. advanceEpoch mixes fresh externally coordinated secret material into the root state, increments the epoch, and invalidates both active direction chains, counters, KEM transition state, and skipped-message keys.

The low-level root facade exposes the same operations under pairwiseChannel. The WASM ABI is limited to:

• pc_generate_sealed_identity
• pc_export_prekey_bundle_for_one_time_prekey_sealed
• pc_export_prekey_bundles_sealed
• pc_initiate_sealed
• pc_respond_sealed
• pc_reseal_identity
• pc_encrypt
• pc_decrypt
• pc_advance_epoch
• pc_reseal

StateKeyProvider.deriveKey must return a fresh caller-owned 32-byte array. The TypeScript wrapper validates and zeroizes that array after every successful or failed WASM operation. Built-in providers clone backend output before returning it and zeroize transient key material. JavaScript strings cannot be deterministically wiped, so encoded key arguments must remain local and must never be logged, persisted, or transmitted.