Service 06

Developer Implementation Support

Code-level guidance for integrating ML-KEM, ML-DSA, and SLH-DSA into real systems, plus a pre-flight checklist before you ship.

ML-KEM key encapsulation (Node.js, liboqs bindings)

javascript

import { KeyEncapsulation } from "liboqs-node";

const kem = new KeyEncapsulation("ML-KEM-768");
const publicKey = kem.generateKeypair();

// Sender: encapsulate against the recipient's public key
const { ciphertext, sharedSecret } = kem.encapSecret(publicKey);

// Recipient: decapsulate to recover the same shared secret
const recovered = kem.decapSecret(ciphertext);
// sharedSecret === recovered

Hybrid TLS 1.3 key exchange (OpenSSL 3.x / oqs-provider)

bash

# Requires OpenSSL 3.x built with the oqs-provider for ML-KEM groups
openssl s_server -cert server.crt -key server.key \
  -groups x25519_mlkem768 -tls1_3

openssl s_client -connect localhost:4433 \
  -groups x25519_mlkem768

ML-DSA signing (Python, liboqs-python)

python

import oqs

with oqs.Signature("ML-DSA-65") as signer:
    public_key = signer.generate_keypair()
    message = b"release-artifact-v1.2.3"
    signature = signer.sign(message)

with oqs.Signature("ML-DSA-65") as verifier:
    is_valid = verifier.verify(message, signature, public_key)

Pre-flight checklist

•Use a FIPS 203/204/205-validated module (check the CMVP/CAVP lists) rather than a draft or unvalidated implementation for production use.
•Prefer hybrid modes (classical + PQC) during the transition unless your threat model specifically calls for PQC-only.
•Budget for larger key, ciphertext, and signature sizes -- ML-KEM and especially SLH-DSA change wire-format assumptions baked into older protocols.
•Design for cryptographic agility: abstract algorithm choice behind an interface so a future swap (e.g., to FN-DSA or HQC once finalized) doesn't require a rewrite.
•Test performance under realistic load -- handshake CPU cost and message size can affect connection-heavy services differently than throughput-heavy ones.
•Track NIST's CAVP test vectors for conformance testing of your specific implementation.