pqc-react-native-sdk

An enterprise-ready Post-Quantum Cryptography (PQC) SDK for React Native.

This SDK abstracts the complexities of establishing ML-KEM-768 shared secrets, deriving HKDF keys, and performing AES-256-GCM symmetric encryption into an easy-to-use, immutable client structure.

This SDK executes mathematically valid KEM operations locally on edge devices using pure JavaScript boundaries.

Installation

npm install pqc-react-native-sdk
# or
yarn add pqc-react-native-sdk

Peer Dependencies

Because this SDK operates securely within React Native, it requires the following polyfills and cryptographic suites to be installed in your hosting application:

npm install react-native-get-random-values base-64 @noble/post-quantum @noble/hashes @noble/ciphers

Make sure to import 'react-native-get-random-values' at the very top of your application entry point (e.g., App.tsx or index.js).

Usage

1. Initialization

Create an instance of the PQCClient and provide your API configuration. The instance itself strictly freezes the configuration to ensure immutability throughout the application flow.

import { PQCClient } from 'pqc-react-native-sdk';

const pqcClient = new PQCClient({ serverUrl: 'https://api.yourdomain.com' });

// Fetch the active ML-KEM Server Public Key securely
await pqcClient.init();

if (pqcClient.isInitialized()) {
    console.log("Ready for Post-Quantum Encryption!");
}

2. Payload Encryption (Outbound)

When you want to send a secure payload to your server, simply pass the JSON object to the encryptPayload() function. The SDK handles generating the ML-KEM shared secret, the HKDF, and the AES symmetric ciphering.

const mySecureData = {
    userId: "123",
    creditCard: "4444-4444-4444-4444"
};

// Generates the ciphertext block and captures the symmetric key used
const { requestBody, aeadKey } = pqcClient.encryptPayload(mySecureData);

// Send the strictly formatted KEM structure to your backend API
const response = await fetch('https://api.yourdomain.com/v1/decrypt', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(requestBody)
});

const encryptedServerData = await response.json();

3. Response Decryption (Inbound)

Assuming your backend executes a 2-way True Post-Quantum flow using the same derived symmetric key to encrypt its response, you can easily decode the response using the aeadKey stored from step 2.

// Using the exact `aeadKey` derived during the encryptPayload routine
const decryptedPayload = pqcClient.decryptResponse(aeadKey, encryptedServerData);

console.log("Server responded with: ", decryptedPayload);

Security

This SDK assumes your backend properly issues standardized kid and spki blocks matching the ML-KEM-768 parameter specifications.