Modern and post quantum cryptography

Most of this wiki walks through AES and RSA, and that's still the right tool for most jobs. But a large-scale quantum computer would break RSA and classic Diffie-Hellman outright, password cracking has gotten cheap enough on GPUs that yesterday's "fast hash + salt" isn't enough anymore, and a handful of subtler gaps (multi-recipient ciphertexts openable under different keys, secret shares that silently reconstruct wrong) have real names and real fixes. mystic-crypt closes all of that - most of it added in one focused pass through the library, verified end-to-end before being wired in.

Here's what's under the hood:

Category	What	Class(es)
Signatures & key agreement (JDK-native)	Ed25519 signatures, X25519 key agreement	key.Ed25519Signer/Verifier, key.X25519KeyExchange
Post-quantum (NIST FIPS 203/204/205)	ML-KEM, ML-DSA, SLH-DSA, and a hybrid X25519+ML-KEM combiner	key.MlKemKeyExchange, key.MlDsaSigner/Verifier, key.SlhDsaSigner/Verifier, key.HybridKemKeyExchange
Password hashing	Argon2id (recommended), PBKDF2, bcrypt, scrypt	PasswordEncryptor, sha.BcryptHasher, sha.ScryptHasher
Symmetric & hashing	ChaCha20-Poly1305, SHA-3 (224/256/384/512), BLAKE2b/BLAKE2s (incl. keyed/MAC mode), key-committing AEAD	MysticSymmetricAlgorithm, sha.Sha3Hasher, sha.Blake2bHasher/Blake2sHasher, aead.KeyCommittingAeadEncryptor
Secret sharing & protocols	Shamir's Secret Sharing, Feldman VSS, J-PAKE, SRP-6a, AES Key Wrap, PKCS#11/HSM	secret.FeldmanVSS, key.JpakeKeyExchange, srp.SRP6a*, crypt-data's factory.*

A couple worth a second look:

Hybrid KEM doesn't ask you to bet on post-quantum cryptography or trust the classical math - it combines both, so the shared secret stays safe as long as either half holds.

Key-committing AEAD closes a gap plain AES-GCM has: without it, a malicious sender can craft one ciphertext that decrypts to different plaintexts depending on which key opens it - the "invisible salamanders" attack. Only matters if a ciphertext might ever be opened by more than one keyholder (multi-recipient encryption, abuse-report re-decryption), but when it matters, it matters a lot.

Feldman VSS fixes something Shamir's Secret Sharing can't warn you about on its own: combine too few (or the wrong) shares and plain Shamir hands you back a wrong secret, silently. Feldman adds public commitments so a share can be checked against them before you ever try to reconstruct.

For the exhaustive version - every algorithm, what's deliberately not implemented and why, mutation test coverage - see docs/CRYPTO_CAPABILITIES.md in the repository. That document is the source of truth; this page is the highlight reel.