Shurli v0.4.1 — Post-Quantum Cryptography (Phase 11 complete)
20 commits since v0.4.0. PQ Noise transport, PQC status introspection, security advisory triage, Phase 11C documentation and blog.
Post-Quantum Cryptography
- PQ Noise transport (
/pq-noise/1): dual-layer PQ protection via go-clatter —36ceca0,3eedc6c - libp2p integration: PQ Noise registered as security transport, gater enforcement, config —
9ff2ff7 - PQC status reporting: per-layer detail (QUIC PQ, Noise PQ, per-connection breakdown) —
b2cf954,ea4dd93 - QUIC PQ verification: X25519MLKEM768 detection via TLS ConnectionState —
b271bf4 - Phase 3 adversarial audit: buffer zeroing, empty write guard, relay downgrade logging —
ed1718e
PQC Policy
| Mode | Behavior |
|---|---|
opportunistic (default) |
Prefer PQ Noise, fall back to classical. Log relay downgrades. |
mandatory |
Reject non-PQ TCP/WS connections. QUIC always allowed (PQ at TLS layer). |
disabled |
Classical Noise only. |
Per-peer override via authorized_keys attribute: pqc=mandatory.
Security
- GHSA-hpxw-4hqh-q2m3 triage: pprof localhost bind, crypto/rand in mDNS, os.Executable in join, go-ipld-prime bump —
dc1c5f2,3a55d66 - golang.org/x/net v0.52.0 -> v0.53.0 (GO-2026-4918 HTTP/2 infinite loop fix)
Documentation
- Engineering journal: 6 ADRs (PQ01-PQ06) covering dual-layer strategy, go-clatter port, transport integration, policy enforcement, status introspection, ML-DSA-65 signing
- Blog: "Quantum-Proof Connections" with threat landscape analysis (Google Willow, CNSA 2.0, NIST FIPS 203/204/205, harvest-now-decrypt-later)
- ARCHITECTURE.md: PQC section with transport, config, gater, and status documentation
- Phase renumbering: Phases 12-24+ restructured for PQC + agent + federation priority
External Libraries (separate repos)
| Library | Version | What |
|---|---|---|
| go-clatter | v0.1.0 + v0.2.0 | PQ Noise (5 handshake modes, 233+ tests, 408 interop vectors) + ML-DSA-65 signing |
| go-bip85 | v0.1.0 | BIP85 deterministic entropy derivation |
| go-slip39 | v0.1.0 | Shamir's Secret Sharing for seed backup (294 tests, 5 fuzz targets) |
Verified Counts
- 28 test packages, all PASS with
-race -count=1 - 79 admin API endpoints (45 daemon + 34 relay)
- 19 P2P protocols (17 application + 1 security + 1 DHT)
- 53 files changed, 6,011 insertions