This application lets you try Post-Quantum Cryptography (PQC) algorithms in two modules:
-
PKI Dashboard: create certificate chains, certificate requests (CSRs), user certificates and revocation lists (CRLs).
-
CMS Dashboard: encrypt and sign data with Cryptographic Message Syntax (CMS), the format used by secure email (S/MIME), PDF signatures (PAdES), timestamps and certificate enrollment (EST).
The connection to this server uses TLS 1.3 with the hybrid key exchange X25519MLKEM768. Browsers that do not support it fall back to X25519.
Built with Bouncy Castle 1.83. Certificates and keys follow the current standards and can be used with other tools, for example OpenSSL 3.6 or later.
Public Key Infrastructure using PQC
Certificate chains
- Create a two-level CA hierarchy: a root CA and an intermediate CA.
-
Three certificate types are available:
- Pure PQC: signed with a single PQC algorithm (ML-DSA, HashML-DSA or SLH-DSA).
- Composite: a classical key and a PQC key are combined into one key, and both signatures into one signature.
- Catalyst: a classical certificate that carries the PQC key and signature in extensions.
-
For each chain you can:
- Download the CA certificates of the chain.
- Download the CA keys (private and public) of the chain.
- Issue a CRL, signed by the intermediate CA with the same algorithm as the chain.
Signing certificates
- Generate a CSR for a Pure PQC, Composite or Catalyst certificate. The application creates the key pairs for you, or you can upload your own.
- Choose a chain and get the certificate issued by its intermediate CA.
Encryption certificates
- Get an ML-KEM certificate (ML-KEM-512, 768 or 1024) for secure email (S/MIME). An encryption key cannot sign, so no CSR is needed: the CA issues the certificate directly.
- The application creates the key pair for you, or you can provide your own ML-KEM public key.
- The certificate contains your email address and is limited to encryption. It works with S/MIME clients that support ML-KEM, for example OpenSSL 3.6 or later.
Verification and visualization
- Verify CSRs, certificates and CRLs.
- View the structure and content of CSRs, CRLs and certificate chains.
Cryptographic Message Syntax using PQC
The CMS Dashboard creates encrypted messages (EnvelopedData) and signed messages (SignedData) with PQC keys. A signed message can carry a single signature or two signatures, one classical and one PQC.
Encryption
- Generate an ML-KEM key pair and use it to encrypt and decrypt data.
- View the structure of the encrypted message.
Signature
- Generate an ML-DSA or SLH-DSA key pair and use it to sign and verify data.
- Sign and verify messages with one signature or with two (classical and PQC).
- Sign data without CMS: the result is a JSON file with the data and its PQC signature, which can be verified here.
- Verify PDF signatures (PAdES) made with PQC keys.
- View the structure of signed messages.
Contribution
To report a bug or suggest an improvement, please use the feedback form.
Authors
Digital ID Innovation Team
Van-Hoan Hoang, van-hoan.hoang@atos.net
