What is PQ Crypta?

PQ Crypta defines a new category of security infrastructure: the Post-Quantum Operational Intelligence Platform (PQ-OIP) — a unified environment that validates, observes, and operationalizes post-quantum cryptography across real systems, real protocols, and real deployments.

A PQ-OIP is not a library. Not a PKI vendor. Not a migration consultancy. It is a living operational substrate that gives engineering teams the same capabilities observability platforms gave SREs: continuous insight, reproducible validation, and actionable intelligence for a cryptographic world undergoing irreversible change.

What Makes This a New Category?

Existing players occupy narrow buckets:

• PQC Libraries (liboqs, pqm4) → Code, not operations
• PKI Vendors → Certificates, not protocol behavior
• Crypto-Agility Platforms → Inventory, not validation
• Consultancies → Documents, not reproducible tooling
• Research Labs → Papers, not operational systems

None combine protocol scanning, operational observability, reproducible validation, and developer-centric tooling into a single platform. PQ Crypta is the first.

The Four Pillars of PQ-OIP

PQ Crypta delivers post-quantum operational intelligence through a dual-architecture system: interactive PHP/JavaScript applications for hands-on exploration, and a high-performance Rust API backend for production integration.

Core Mission: Provide continuous cryptographic observability and actionable intelligence for teams preparing for the post-quantum transition — from protocol validation to production deployment.

Dual Architecture Design

1. Frontend Layer (PHP 8.4 + Vanilla JavaScript ES6)

• 30+ interactive web applications
• Zero-knowledge client-side cryptography
• Real-time visualization (Three.js, WebGL, WebGPU)
• Modern build system (Vite.js 7.0.4)
• Deployed on Apache HTTP/2 (port 8080)

2. Backend API Layer (Rust + Axum Framework)

• 588 REST API endpoints (343 static + 245 algorithm-specific)
• Engines built on the NIST FIPS-final crates (with backward-compatible decryption of round-3 ciphertexts)
• High-performance async runtime (Tokio)
• Enterprise business logic services
• PostgreSQL database integration
• Deployed on Rust API server (port 3003)

Endpoint Breakdown:

• 343 static endpoints (core services, analytics, auth, discovery, scanners, etc.)
• 245 algorithm-specific endpoints across 35 algorithms (7 core operations each)
• Operations per algorithm: /keys/generate/:algorithm, /encrypt/:algorithm, /decrypt/:algorithm, /validate/:algorithm, /info/:algorithm, /benchmark/:algorithm, /algorithms/info/:algorithm

3. Reverse Proxy Layer (pqcrypta-proxy — custom Rust)

• Purpose-built Rust reverse proxy (Rustls + Quinn) deployed on three global nodes (US East, US Midwest, US East 2)
• HTTP/3 with QUIC, HTTP/2, WebTransport (port 4433), and 103 Early Hints preloading
• TLS 1.3 with post-quantum hybrid key exchange (X25519MLKEM768) and integrated ACME certificate management
• Live pure-PQ TLS endpoint: pqc.pqcrypta.com serves an ML-DSA-87 certificate chain rooted in SLH-DSA
• WAF, JA3/JA4 TLS fingerprinting, GeoIP country blocking, rate limiting, bot protection, honeypot pipeline
• Response caching, load balancing, circuit breakers, and traffic routing between frontend (pqcrypta.com) and API (api.pqcrypta.com)

4. Database Layer (PostgreSQL 15)

• Comprehensive analytics tracking
• Health monitoring with 30-day retention
• GDPR-compliant dual-mode tracking (anonymous + consented)
• Cryptographic asset discovery inventory
• User authentication and session management

5. ML/AI Layer (Python 3.11 + Gemini 2.5 Flash)

• The Wizard AI Chatbot with RAG (FAISS vector store, 130,000+ vectors)
• ML-based compression algorithm selection (RandomForest)
• HTTP/3 recommendation engine (RandomForest, 100 trees)
• Threat detection and bot classification

6. Automation Layer (Cron Jobs + Scripts)

• 15-minute health check validation (588 endpoints, real cryptographic workflows)
• Daily RAG indexer (codebase documentation, 130,000+ vectors)
• Hourly bot analytics parsing
• 6-hour news refresh automation
• Nightly database maintenance and cleanup (30-day GDPR retention)

All algorithms verified operational with 100% success rate across full cryptographic workflows (Key Generation → Encryption → Decryption → Validation). Every engine performs real KEM encapsulation and signature verification — independently audited with tamper-rejection tests (modified ciphertexts are refused with HTTP 422).

Max Secure Series (6 algorithms)

• Max Secure: Lightweight - Ascon-AEAD128 (NIST lightweight standard) for IoT/embedded
• Max Secure: Pure PQ - Maximum quantum resistance, pure PQC
• Max Secure: Hybrid Transition - Hybrid with transition support
• Max Secure: Stateless - Stateless signature schemes
• Max Secure: Crypto-Agile - Runtime-negotiated KEM/signature agility
• Max Secure: PQC + ZK Stack - Zero-knowledge proofs + PQC

FN-DSA Signature Series (6 algorithms)

• FN-DSA 512: Compact - Fast NTRU-based signatures, compact
• FN-DSA 1024: High-Security - NTRU-based, high security level
• FN-DSA: Floating-Point Hardened - FP-hardened implementation
• FN-DSA: Dual Signature - Dual signature support
• FN-DSA: Transition Stack - Transition-ready signatures
• FN-DSA + ZK Stack - FN-DSA with zero-knowledge proofs

Experimental Series (5 algorithms)

• Quantum-Inspired Lattice Fusion - Research-grade lattice cryptography
• Post-ZK Homomorphic Stack ⭐⭐⭐⭐⭐ MOST COMPLEX
  • Zero-Knowledge Proofs + Fully Homomorphic Encryption + ML-KEM-1024
  • Allows computations on encrypted data with privacy proofs
  • Key size: ~400 MB (largest), Performance: 100x+ slower (most intensive)
  • Use case: Confidential smart contracts, privacy-preserving cloud computing
• Quantum-Resistant Consensus - Consensus algorithms with PQC
• Entropy-Orchestrated PQ Stack - Entropy-based algorithm orchestration
• AI-Synthesized Crypto-Agile - AI-driven algorithm selection

Code-Based KEM Series (4 algorithms) — NIST Backup Standards

• HQC-128 - NIST Level 1 code-based KEM (2025 backup standard)
• HQC-192 - NIST Level 3 code-based KEM
• HQC-256 - NIST Level 5 code-based KEM
• Classic McEliece 348864 - Conservative code-based KEM with a 40+ year cryptanalysis record (real PQClean implementation)

2026 KEM Additions (3 algorithms)

• X25519MLKEM768 - The IETF hybrid key exchange used in TLS today (Chrome/Firefox default), now a first-class engine
• FrodoKEM-976 - Unstructured-lattice KEM (no ring structure to attack), Level 3
• FrodoKEM-1344 - Unstructured-lattice KEM, Level 5

Password-Based (1 algorithm)

• Password-Classical - PBKDF2-SHA256 key derivation + AES-256-GCM

Algorithm Performance Rankings:

• Fastest: Classical (baseline) → Hybrid (2-3x slower) → ML-KEM Pure (5x slower)
• Slowest: Post-ZK Homomorphic (100x+ slower, most complex)
• Key Size Range: Classical (~64 bytes) → Post-ZK Homomorphic (~400 MB)

PQ Crypta features an extensive collection of interactive web applications spanning encryption, compression, security scanning, AI tools, visualizations, and entertainment.

1. Encryption Suite (/encryption/index.php)

Purpose: Zero-knowledge client-side encryption with 35 algorithms (33 quantum-resistant)

• Dual Modes: Password Mode (simple) & Key Mode (advanced)
• 35 Total Algorithms: All quantum-resistant options available
• File Support: Text, documents, images, videos, archives (zero file size limits)
• Security: All operations client-side; keys never leave device
• Technology: @noble/post-quantum, @noble/curves, Vite.js, WebAssembly

2. Compression Platform (/compression/index.php)

Purpose: Advanced data compression testing with 14 algorithms and ML-based auto-selection

• 14 Compression Algorithms: Zstandard, Brotli, LZMA, LZ4, Snappy, Deflate, GZIP, PPMd, Arithmetic Coding, BWT, Fractal, Quantum-Inspired, Neural Network, CMIX
• ML Auto-Selection: RandomForest model recommends optimal algorithm
• PQCZ Format: PQCrypta Compressed format with metadata headers

3. PQC Readiness Scanner (/pqc-ready/index.php)

Purpose: Website TLS analysis for post-quantum cryptography support

• Grading System: A+ (PQC Ready + No Downgrade Risk), A (PQC Ready + Downgrade Risk), F (Not PQC Ready)
• Algorithm Detection: ML-KEM, ML-DSA, hybrid TLS configurations
• Certificate Analysis: X.509 parsing, signature algorithm validation

4. HTTP/3 & QUIC Scanner (/http3-quic/index.php)

Purpose: Protocol detection and performance analysis for modern web protocols

• 5-Tier Grading: A++ (HTTP/3 accessible + 0-RTT off + WebTransport + measured PQC hybrid key exchange), A+ (HTTP/3 accessible + 0-RTT off), A (HTTP/3 accessible + 0-RTT on, replay risk), C (HTTP/3 enabled but misconfigured, no Alt-Svc), F (no HTTP/3)
• Certificate Analysis: subject/issuer/validity/key size/signature algorithm, explicit PQC and composite classical+PQC signature detection, chain length, root CA, OCSP stapling, must-staple, Certificate Transparency SCT count
• RFC 9218 Extensible Priorities: active PRIORITY_UPDATE frame test, not just passive header inspection
• Multipath QUIC probe: experimental capability check for the draft-ietf-quic-multipath-21 extension (informational, not graded — still an active IETF draft)
• ML Recommendations: RandomForest model suggests protocol upgrades

5. Hardware Entropy Generator (/entropy/index.php)

Purpose: Interactive cryptographic randomness generation with quality testing

• 4 Entropy Sources: Hardware (CPU RDRAND), System (/dev/urandom), Quantum (ANU QRNG), Mixed (XOR combination)
• NIST Statistical Tests: Frequency, Block Frequency, Runs, Longest Run of Ones
• Quality Scoring: 0-10 scale with comprehensive metrics

6. The Wizard AI Chatbot (/ent/ml/src/chatbot/qwen_chatbot.py)

Purpose: Codebase-aware AI assistant with RAG, comprehensive PQCrypta algorithm knowledge, and security filtering

• AI Model: Gemini 2.5 Flash (high-speed inference, 1M-token context)
• RAG System: FAISS Vector Store with 130,000+ total vectors
• Security Features: Prompt injection detection, output filtering, risk scoring
• Comprehensive Algorithm Knowledge: Embedded knowledge of all 35 PQCrypta algorithms

7-30. Additional Applications

• Discovery Agent - Cross-platform cryptographic asset discovery (Linux/Windows/macOS): TLS/keystore/appliance scanning (F5 BIG-IP, Citrix NetScaler), JKS/PKCS12 inventory, and CBOM export (CycloneDX 1.6)
• Encrypt & Share - Nested dual-KEM sharing links: HQC-256 wrapped around ML-KEM-1024, so both algorithms must fall before data is exposed
• QUIC Speed Test - WebTransport-native speed and latency test served from three US nodes
• Live PQ-TLS Demo - pqc.pqcrypta.com: TLS terminated with an ML-DSA-87 certificate chain rooted in SLH-DSA
• AI Regex Generator - Natural-language regex creation with instant testing across 22 languages
• PQC Benchmark & Analysis - Browser-side algorithm benchmarking with a published statistical analysis of real run data
• Interactive Mouse Effects - Custom cursor animations and visual effects
• Streaming Music Player - High-performance MP3 player with quantum-resistant encryption
• SQL Query Generator - Natural language to SQL converter
• WebTransport Streaming Test - HTTP/3 WebTransport testing with PQC encryption
• Web Analytics Platform - Enterprise-grade analytics with GDPR compliance
• PQC Challenge Mode - Educational cryptography puzzle platform
• Threat Detection Dashboard - Real-time bot attack monitoring
• Bot Threat Remediation - Automated bot mitigation tools
• Contact Form - Secure contact form with anti-spam
• Quantum Morphic Field Explorer - Interactive quantum field visualization
• Educational Animations - Cosmic Fluid, Neural Network, Fractal Tree, Particle System, etc.
• Resume Fixer - AI-powered resume analysis and improvement
• News Widget - Quantum computing and cryptography news aggregator
• ...and more!

Endpoint Categories

Total Endpoints: 588

• Static Endpoints: 343 (core services)
• Algorithm-Specific Endpoints: 245 (35 algorithms, 7 core operations each)

Static Endpoint Breakdown (343 endpoints)

Category	Count	Description
Authentication & Authorization	35	Login, OAuth, 2FA, API key management
Encryption & Cryptography	45	Key generation, encryption/decryption, validation
Analytics	60	Web analytics, tracking, metrics, exports
ML/AI Services	20	Compression, threat analysis
Streaming	15	Stream encryption, WebTransport, session management
Batch Processing	12	Job submission, status queries, batch operations
Quantum Validation	10	Validation status, readiness verification, metrics
Zero-Knowledge Proofs	8	ZK proof generation, verification, schemes
Compliance & Audit	15	Audit logging, compliance config, certificates
Utilities	50+	Compression, health checks, benchmarks, statistics
Scanner Services	15	PQC scanning, HTTP/3 scanning, statistics
Threat & Bot Management	20	Threat dashboard, bot classification, remediation
Music & Media	10	Track listing, streaming, playlist management
Miscellaneous	20+	Contact, news, resume analysis, sessions

Algorithm-Specific Endpoints (245 endpoints)

7 core operations per algorithm × 35 algorithms = 245 endpoints

For each of the 35 algorithms (33 quantum-resistant):

1. GET /keys/generate/:algorithm - Generate key pair
2. POST /encrypt/:algorithm - Encrypt data
3. POST /decrypt/:algorithm - Decrypt data
4. POST /validate/:algorithm - Validate keys
5. GET /info/:algorithm - Algorithm information
6. POST /benchmark/:algorithm - Performance benchmark
7. GET /algorithms/info/:algorithm - Detailed algorithm specs

Example URLs:

• GET https://api.pqcrypta.com/keys/generate/hybrid
• POST https://api.pqcrypta.com/encrypt/post-zk-homomorphic
• POST https://api.pqcrypta.com/decrypt/ml-kem-1024
• GET https://api.pqcrypta.com/info/max-secure-pqc-zk

PostgreSQL 15 Schema

Database: pqcrypta
User: pqcrypta_user

Core Tables

• Health Check Tables - 588-endpoint health monitoring with 15-minute cache
• Analytics Tables - Web analytics sessions, pageviews, events, errors (GDPR-compliant)
• Crypto Discovery Tables - Cryptographic asset inventory
• Threat Detection Tables - Bot attack logs, whitelists, patterns
• ML/AI Tables - Wizard sessions, messages, security logs, compression recommendations
• Scanner Tables - PQC scan results, HTTP/3 scanner results
• User Management Tables - Users, API keys with granular permissions, sessions, 2FA configs
• News & Content Tables - News articles, categories
• Configuration Tables - Feature flags, rate limits, system config

Database Performance

• Connection Pooling: PgBouncer (max 100 connections)
• Query Optimization: B-tree indexes on frequently queried columns
• Retention Policies: Automated cleanup (30 days for GDPR compliance)
• Backup Schedule: Nightly full backups, hourly incrementals

Python ML Services

Location: /var/www/html/public/ent/ml/
AI Model: Gemini 2.5 Flash (high-speed inference, 1M-token context)

1. The Wizard AI Chatbot

• RAG System: FAISS vector store (130,000+ vectors)
• Comprehensive Algorithm Knowledge: All 35 PQCrypta algorithms embedded in system prompt
• Security Features: Prompt injection detection, output filtering, risk scoring (0.0-1.0)
• Caching: Redis (60-minute TTL)

2. Compression ML Service

• Model: RandomForest (scikit-learn)
• Training: 10,000+ compression scenarios
• Accuracy: 94.3%

3. HTTP/3 Recommendation Engine

• Model: RandomForest (100 trees)
• Training: 500+ website scans
• Accuracy: 89.7%

4. Threat Detection Classifier

• Model: Gradient Boosting (XGBoost)
• Training: 50,000+ bot request patterns
• Accuracy: 96.8%

1. Health Check Automation

Schedule: Every 5 minutes
Script: /var/www/html/public/ent/scripts/health_check_cron.rs

• Tests all 588 API endpoints with real cryptographic workflows
• Updates health_checks table with results
• Caches results (5-minute expiration)
• Sends alerts if critical endpoints fail

2. RAG Indexer

Schedule: Daily at 2:00 AM
Script: /var/www/html/public/ent/ml/scripts/index_codebase.py

• Scans codebase for documentation updates
• Generates embeddings using sentence-transformers
• Updates FAISS vector store (current: 130,000+ vectors)

3. Bot Analytics Parser

Schedule: Hourly
Script: /var/www/html/public/scripts/parse_bot_logs.sh

• Parses proxy access logs
• Classifies attacks (SQL injection, XSS, etc.)
• Triggers blocking rules for confirmed attacks

4. News Refresh

Schedule: Every 6 hours
Script: /var/www/html/public/news/fetch_news.php

• Fetches 50+ RSS feeds
• AI summarizes new articles
• Stores in PostgreSQL

5. Database Maintenance

Schedule: Nightly at 3:00 AM
Script: /var/www/html/scripts/db_cleanup.sql

• Deletes data older than 30 days (GDPR)
• Vacuums tables for performance
• Generates database statistics

1. TLS Configuration

• Protocol: TLS 1.3 only (TLS 1.2 disabled)
• Key Exchange: X25519MLKEM768 (hybrid PQC)
• Cipher Suites: CHACHA20-POLY1305, AES-256-GCM
• HSTS: Enabled (max-age=31536000, includeSubDomains)

2. Content Security Policy (CSP)

default-src 'self';
script-src 'self' 'nonce-{random}';
style-src 'self' 'nonce-{random}';
img-src 'self' data: https:;
connect-src 'self' https://api.pqcrypta.com;
frame-ancestors 'none';
upgrade-insecure-requests;

3. Web Application Firewall (WAF)

• Rules: OWASP Core Rule Set 3.3
• Blocking: SQL injection, XSS, path traversal, RCE
• Rate Limiting: 100 requests/minute per IP
• IP Blocking: Automated for repeated attacks

4. Bot Protection

• Good Bot Whitelist: Googlebot, Bingbot, monitoring services
• Challenge-Response: JavaScript execution, cookie support tests
• CAPTCHA: Google reCAPTCHA v3 for suspicious traffic
• Honeypots: Decoy endpoints to trap bots

5. GDPR Compliance

• Data Minimization: Only collect necessary data
• Anonymization: Truncated IPs, hashed visitor IDs
• 30-Day Retention: Automatic cleanup
• User Rights: Data export, deletion requests

API Performance

• Average Response Time: 45ms (p50), 120ms (p95)
• Throughput: 10,000 requests/second
• Uptime: 99.95% (30-day average)

Algorithm Performance

• Classical: 1.2ms key gen, 0.8ms encrypt, 0.7ms decrypt
• Hybrid: 3.5ms key gen, 2.1ms encrypt, 1.9ms decrypt
• Post-Quantum: 6.2ms key gen, 4.3ms encrypt, 3.8ms decrypt
• Post-ZK Homomorphic: 850ms key gen, 1,200ms encrypt, 1,100ms decrypt

Database Performance

• Connection Pool: 100 max connections (PgBouncer)
• Query Time: 15ms average, 85ms p95
• Table Size: 12 GB total

Frontend Performance

• First Contentful Paint (FCP): 1.2s
• Largest Contentful Paint (LCP): 2.3s
• Time to Interactive (TTI): 3.1s
• Cumulative Layout Shift (CLS): 0.05

Frontend

• PHP: 8.4.10 (latest)
• JavaScript: ES2024
• Build Tool: Vite 7.0.4
• Libraries: @noble/post-quantum, @noble/curves, Three.js, Chart.js 4.4.0, D3.js 7.8.5

Backend

• Language: Rust 1.75+ (nightly features)
• Framework: Axum 0.7 (async web framework)
• Runtime: Tokio (async runtime)
• Database Driver: SQLx (async PostgreSQL)

Database

• PostgreSQL: 15
• Connection Pool: PgBouncer
• Backup: Barman (nightly full, hourly incremental)

Reverse Proxy

• pqcrypta-proxy: Rust-based reverse proxy
• Protocols: HTTP/3, QUIC, HTTP/2, WebTransport
• TLS: Rustls (PQC support, ML-KEM native)
• WebTransport: Port 4433

ML/AI

• Python: 3.11
• Framework: scikit-learn, XGBoost
• Embeddings: sentence-transformers
• Vector Store: FAISS
• LLM API: Gemini 2.5 Flash

Last Updated: 2026-07-19

Operational Status

• ✅ All 35 Algorithms: 100% operational (full cryptographic workflow validation)
• ✅ 588 API Endpoints: Monitored every 15 minutes with real cryptographic tests — 100% healthy
• ✅ 30+ Web Applications: All functional and deployed
• ✅ ML/AI Services: RAG index (130,000+ vectors) rebuilt nightly, ML compression/threat models live
• ✅ Database: PostgreSQL 15 healthy, 30-day GDPR retention active
• ✅ Security: WAF active, JA3/JA4 fingerprinting, bot protection, TLS 1.3 with PQC hybrid across three proxy nodes

Recent Enhancements (July 2026)

1. ✅ FIPS-Final Migration - All engines moved from round-3 to NIST FIPS-final crate implementations, with backward-compatible decryption of legacy ciphertexts
2. ✅ Engine Wiring Audit - Every engine independently verified to perform real KEM encapsulation and signature verification, including negative tests (tampered ciphertexts rejected with HTTP 422)
3. ✅ Four New KEM Engines - X25519MLKEM768 (the TLS hybrid used by browsers today), FrodoKEM-976/1344 (unstructured lattices), and Classic McEliece 348864 (real PQClean)
4. ✅ Live Post-Quantum TLS - pqc.pqcrypta.com serves TLS with an ML-DSA-87 certificate chain rooted in SLH-DSA — a working pure-PQ PKI, not a demo mock
5. ✅ PQC Binary Format v2.0.0 - Interop-verified Rust/Python/Go bindings for the IETF-draft packed format, published to crates.io, PyPI, and npm
6. ✅ Discovery Agent Expansion - Network appliance scanning (F5 BIG-IP, Citrix NetScaler), Java keystore inventory, TLS-to-host attribution, and CBOM export (CycloneDX 1.6)
7. ✅ On-Prem Deployment - Docker Compose self-hosted bundle (DB + API + dashboard) with ML-DSA-signed license gating and air-gap support