Quill is a peer-to-peer messenger built in C++23 that is fully resistant to quantum computer attacks. It implements the NIST post-quantum standards (FIPS 203, FIPS 204) for key exchange and digital signatures, combined with AES-256-GCM for session encryption.
Built as a semester project at AGH University of Science and Technology, Kraków.
Foundation for an upcoming engineering thesis on intelligent PQC algorithm selection.
Classical asymmetric cryptography (RSA, ECDH) is theoretically broken by Shor's algorithm running on a sufficiently large quantum computer. In 2024, NIST published the first quantum-resistant standards. Quill implements them from scratch — no TLS, no OpenSSL handshake, custom protocol.
Classical crypto Post-quantum (Quill)
───────────────── ──────────────────────
RSA-2048 → broken Kyber-768 → FIPS 203 ✓
ECDH → broken Dilithium → FIPS 204 ✓
AES-256-GCM → safe* AES-256-GCM → session ✓
* Grover's algorithm reduces AES-256 to ~128-bit security — still safe.
Quill implements a custom 4-step handshake. There is no classical asymmetric crypto anywhere in the stack.
ALICE BOB
│ │
│──── ① ClientHello ────────────────────────►│
│ security level, supported algos, │
│ Alice's Dilithium public key │
│ │ generates Kyber keypair
│ │ signs pub_kyber with Dilithium
│◄─── ② ServerHello ──────────────────────── │
│ pub_kyber_B, pub_dil_B, │
│ sig_B(pub_kyber_B) │
│ │
│ verify sig_B ✓ │
│ Kyber encaps(pub_kyber_B) │
│ → (ciphertext, shared_secret) │
│ │
│──── ③ ClientKeyExchange ──────────────────►│
│ ciphertext, sig_A(ciphertext) │
│ │ verify sig_A ✓
│ │ Kyber decaps → shared_secret
│◄─── ④ ServerFinished ───────────────────── │
│ sig_B(hash(shared_secret)) │
│ │
│ key = HKDF(shared_secret) │ key = HKDF(shared_secret)
│ │
│════════ AES-256-GCM encrypted session ═════│
│ nonce(12B) ‖ ciphertext ‖ GCM tag(16B) │
Security properties:
| Property | Mechanism |
|---|---|
| Quantum-safe key exchange | Kyber-768 (ML-KEM, FIPS 203) |
| Mutual authentication | Dilithium (ML-DSA, FIPS 204) |
| MITM protection | Dilithium signatures + TOFU known_hosts (block on key change) |
| Forward secrecy | New Kyber keypair per session |
| Session encryption | AES-256-GCM |
| Key derivation | HKDF-SHA256, salt = handshake transcript |
| Nonce safety | 96-bit random nonce per message |
| Replay protection | Per-direction sequence numbers bound via GCM AAD (CHAT|<seq>); receiver rejects seq ≤ last (fail-closed), reset on PFS rotation |
Quill supports three configurable security levels, selectable at connection time:
| Level | KEM | Signature | NIST Level | Use case |
|---|---|---|---|---|
FAST |
Kyber-512 | FALCON-512 | 1 (~AES-128) | IoT, real-time |
BALANCED |
Kyber-768 | ML-DSA-65 (Dilithium) | 3 (~AES-192) | default |
MAX |
Kyber-1024 | ML-DSA-87 (Dilithium) | 5 (~AES-256) | critical data |
# Arch Linux
sudo pacman -S cmake openssl
# Ubuntu/Debian (OpenSSL < 3.2 wymaga libargon2 dla szyfrowania profili)
sudo apt install cmake libssl-dev libargon2-devliboqs must be built from source:
git clone https://github.com/open-quantum-safe/liboqs
cd liboqs && mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j$(nproc)
sudo cmake --install .git clone --recurse-submodules https://github.com/Smitchelld/Quill.git
cd Quill
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j$(nproc)If you already cloned without submodules:
git submodule update --init --recursiveRequires Google Test (pacman -S gtest / apt install libgtest-dev):
cd build && ./quill_testsQuill ships as a single ImGui application — each instance can host (server) or connect (client):
./QuillStart one instance in Server mode, then connect another in Client mode (host, port, security level configurable in the setup panel). The PQC handshake runs automatically; after the secure tunnel is established, all messages and file transfers are AES-256-GCM encrypted.
quill/
├── src/
│ ├── crypto/ # CryptoManager, KyberKEM, DilithiumSign, AesGcm, Hkdf,
│ │ # Argon2, IdentityManager, ProfileManager, TrustStore
│ ├── network/ # Socket, NetworkServer, NetworkClient (TCP, length-prefixed framing)
│ ├── protocol/ # MessageFormat (JSON), FileTransfer (chunking + SHA-3)
│ └── frontend/ # ImGui ChatApp, rendering, Theme
├── tests/ # Google Test suite (97 tests), linked against quill_core
├── third_party/ # ImGui (git submodule), portable-file-dialogs
├── .github/workflows/ # CI: build + ctest (headless)
├── docs/ # OVERVIEW.md — stan projektu (PL)
├── main.cpp # GLFW/OpenGL3 + ImGui entry point
└── CMakeLists.txt
┌─────────────────────────────────────────────┐
│ Application layer │
├─────────────────────────────────────────────┤
│ AES-256-GCM (OpenSSL EVP) │ session encryption
├────────────────────┬────────────────────────┤
│ Kyber-768 KEM │ Dilithium DSA │ liboqs
│ (ML-KEM FIPS203) │ (ML-DSA FIPS204) │
├────────────────────┴────────────────────────┤
│ HKDF-SHA256 (OpenSSL EVP_KDF) │ key derivation
├─────────────────────────────────────────────┤
│ TCP (POSIX sockets) │ transport
└─────────────────────────────────────────────┘
Libraries:
- liboqs — Open Quantum Safe, MIT license — Kyber, Dilithium, FALCON, SPHINCS+
- OpenSSL — Apache 2.0 — AES-256-GCM, HKDF, SHA-3, RAND_bytes; Argon2id (≥3.2)
- libargon2 — fallback Argon2id when OpenSSL < 3.2 (e.g. Ubuntu CI)
- nlohmann/json — MIT — message serialization
- No PKI — trust is TOFU-based (like SSH/Signal): the first connection stores the peer key, fingerprints must be compared out-of-band to reach VERIFIED. There is no certificate authority — intentional for scope.
- Passphrase strength is the only offline defense — identity keys are encrypted at rest with Argon2id + AES-256-GCM, but an attacker with the key file mounts an offline attack; there is deliberately no retry lockout (it would be security theater). New profiles require a passphrase of at least 8 characters (repeated single-character strings rejected); legacy profiles can still be unlocked with their original passphrase.
- Server-relayed, not end-to-end — the server is a trusted relay: it decrypts each message from the sender and re-encrypts it per recipient under that link's session key. Every hop is AES-256-GCM, but the server sees plaintext. This is an intentional hub-and-spoke design; true E2E would require a separate per-recipient key agreement.
- NAT traversal — direct TCP, no STUN/TURN. Both peers must be reachable at a known address.
- Kyber-768 key exchange over TCP
- AES-256-GCM encrypted messaging
- Dilithium signature verification (MITM protection)
- FAST / BALANCED / MAX security levels (FALCON-512, ML-DSA-65/87)
- Multi-client with
std::thread - Rooms/channels with message isolation
- Perfect Forward Secrecy — on-the-fly key rotation
- Handshake visualizer with per-step timing, benchmarks, security dashboard
- File transfer (64KB chunks, AES-GCM per chunk, SHA-3-256 integrity)
- HKDF-SHA256 key derivation with handshake-transcript binding
- Unified
CryptoManager(handshake + TOFU + HKDF + identity, UI-free) - Persistent identity keys (0600, self-test on load) + SHA-3 fingerprints
- Local profiles with login — at-rest key encryption (Argon2id + AES-256-GCM)
- TOFU (known_hosts per profile, UNVERIFIED/KNOWN/VERIFIED, fail-closed block on key change)
- Replay protection for chat — per-direction sequence numbers bound via GCM AAD (fail-closed)
- Google Test suite — 97 tests (RFC vectors, tamper + AAD/replay, TOFU attacks, file transfer NACK + chunk_hash, socketpair handshake)
- GitHub Actions CI (headless build + ctest)
- Argon2 dual backend (OpenSSL ≥3.2 or libargon2)
- File transfer: selective repeat retransmission (FILE_NACK)
- File transfer: per-chunk SHA-3 (early integrity check before buffering)
- NAT traversal (UDP hole punching + rendezvous server)
- Engineering thesis: intelligent PQC algorithm selection
- FIPS 203 — ML-KEM (Kyber)
- FIPS 204 — ML-DSA (Dilithium)
- FIPS 205 — SLH-DSA (SPHINCS+)
- CRYSTALS-Kyber: A CCA-Secure Module-Lattice-Based KEM — Bos et al.
- CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme — Ducas et al.
- Open Quantum Safe — liboqs documentation
AGH University of Science and Technology, Kraków
Computer Science and Intelligent Systems
Studio Projektowe — Semester 6