Skip to content

pqblocks-tls-interop

TLS 1.3 hybrid key exchange (X25519MLKEM768 / RFC 10024) endpoint probe, downgrade detector, and key material validator.

Install from GitHub Area Status Python Licence Source

At a glance
Area Interoperability
Import import pqblocks_tls_interop
Command line pqblocks-tls-interop
Version 0.1.0 (Alpha)
Python >=3.11
Native dependency none
Repository PQBlocks/tls-hybrid-interop
Licence Apache-2.0

What is pqblocks-tls-interop?

TLS 1.3 hybrid key exchange (X25519MLKEM768 / RFC 10024) endpoint probe, downgrade detector, and key material validator.

Install

pip install git+https://github.com/PQBlocks/tls-hybrid-interop

uv add git+https://github.com/PQBlocks/tls-hybrid-interop

PyPI release staged

pqblocks-tls-interop installs from its GitHub repository while the PyPI release is staged. The import name and API are identical either way.

Quickstart

Executed, not just written

This is the quickstart from the package README. It was run against the package source when this page was generated.

quickstart.py
from pqblocks_tls_interop import derive_shared_secret_10024, derive_key_material_rfc9954
from pqblocks_tls_interop.verifier.probe import HybridGroupProbe

# 1. Inspect RFC 10024 shared secret specifications
layout = HybridGroupProbe.get_shared_secret_layout()
print(layout["group_name"])  # X25519MLKEM768
print(layout["codepoint"])   # 4588

# 2. Derive combined hybrid shared secret (64 bytes: 32 bytes ML-KEM || 32 bytes X25519)
classical_ss = b"\x01" * 32
mlkem_ss = b"\x02" * 32
combined = derive_shared_secret_10024(classical_ss, mlkem_ss)
assert combined == mlkem_ss + classical_ss

# 3. Derive key material per RFC 9954 (48-byte SHA-384 digest)
km = derive_key_material_rfc9954(classical_ss, mlkem_ss)
assert len(km) == 48

# 4. Probe an external endpoint
probe = HybridGroupProbe("example.com", port=443, timeout=5.0)
result = probe.probe(sni="example.com")
if result.downgrade_detected:
    print(f"Warning: Endpoint downgraded to classical ({result.error_reason})")

Examples

Runnable scripts in the repository:

Documentation and evidence

Every PQBlocks package ships the same evidence set, so each claim can be checked against tests, sources and measurements.

  • Overview

    What it does, install, usage and API.

  • For AI agents

    Correct imports, pitfalls and rules for coding assistants.

  • Security notes

    What it protects, hostile input, constant-time and audit status.

  • Testing

    Test suites, coverage, vectors and what is not covered.

  • Benchmarks

    Measured performance, including where it loses.

  • Evidence

    Primary sources and the method-to-code map.

  • Verification report

    Self-verification results, defects found and limits.

  • Use cases

    Worked scenarios and when to pick something else.

  • Changelog

    Every release and what changed.

  • pqblocks-csr-pop: ML-KEM (FIPS 203) PKCS#10 Certificate Signing Request (CSR) generator with RFC 9883 Proof of Possession (PoP).
  • pqblocks-jwe: Compact five-part wire format, with a serializer and structural parser, for hybrid ML-KEM-768 + X25519 JWE-style…
  • pqblocks-wire: Length-prefixed container format (PQCWF1) for ML-KEM ciphertexts and ML-DSA / SLH-DSA signatures, with thin wrappers…