Which algorithms does Quipu use?

Hybrid encryption: X25519 + ML-KEM-1024 (FIPS 203) for key exchange and Ed25519 + ML-DSA-87 (FIPS 204) for signatures; derivation with Argon2id + HKDF. The post-quantum component resists Shor's algorithm; the classical one is the safety net in case the post-quantum one ever fails.

Why pure Rust and not a C ABI with bindings?

Quipu started with a Rust core, a C ABI on top, and bindings for Python, Node and Go. Each binding was failure surface (memory, types, build) for little value. It was dropped in favor of a native Python wheel via PyO3, which covers most of the non-Rust audience.

How do I use it from Python?

Install it as a native wheel (pip): you generate a key pair (X25519 + ML-KEM-1024) and encrypt/decrypt with the direct API. No need to compile Rust or manage a C ABI: the wheel ships the binary.

What is it for and what is it not for?

It's for data AT REST: encrypting files or fields with a public key or a passphrase. It doesn't replace TLS for data in transit. It protects stored data against 'harvest now, decrypt later'.

Quipu: post-quantum encryption in pure Rust, with a Python wheel

Protecting data that must stay secret ten years from now is a present-day problem: an adversary can capture your encrypted traffic now and decrypt it once quantum capability exists (harvest now, decrypt later). Quipu is a free hybrid post-quantum encryption library for data at rest: it combines proven classical cryptography with the new kind, so it only breaks if both fall at once.

Pure Rust, and why

Quipu started out targeting several languages: a Rust core with a C ABI on top and bindings for Python, Node and Go. It worked, but the lesson was clear: maintaining a stable C interface plus four bindings, each with its own packaging and interop tests, was complexity that didn't pay off for the real goal —protecting data at rest— and it widened the attack surface with unsafe we didn't want.

Today Quipu is pure Rust: memory-safe, no garbage collector, no first-party unsafe. And for non-Rust users, it ships as a native Python wheel (via PyO3) — the surface the non-Rust customer actually needs. One codebase, one thing to audit. It's the same philosophy that guides the rest: where there's good cryptography, reuse it; simplicity is a security decision, not a convenience.

Installation

It is free software (AGPL-3.0), in pure Rust with a native wheel for Python (PyO3). Since August 2026 the code is no longer published on registries or on GitHub, for security: it is delivered on request, signed and with its SHA-256, at contacto@xiliux.com.

Encrypt and decrypt in Python

import quipu

# Symmetric with a passphrase
blob = quipu.encrypt_stream(b"sensitive data", "my-passphrase")
assert quipu.decrypt_stream(blob, "my-passphrase") == b"sensitive data"

# Post-quantum, for a recipient
pub, sec = quipu.generate_keypair()          # X25519 + ML-KEM-1024
c = quipu.encode_to_recipient(b"secret", pub)
assert quipu.decode_as_recipient(c, sec) == b"secret"

What's underneath

Encryption: XChaCha20-Poly1305 (authenticated AEAD).
Key derivation: Argon2id (brute-force resistant) + HKDF.
Post-quantum: X25519 + ML-KEM-1024 for keys; Ed25519 + ML-DSA-87 for signatures.
Security level: NIST category 5 (CNSA 2.0).

Everything is verified, standard primitives —the ML-KEM-1024 and ML-DSA-87 KATs are checked against the official NIST vectors (ACVP)—: Quipu composes them, it doesn't invent its own cryptography.

Free and transparent

Quipu is open source (AGPL-3.0). You can read every line and audit the format, specified byte by byte. The code is delivered on request (see above), with the byte-by-byte format specification included.

Honest status: the composition has not yet passed an independent cryptographic audit; until that external seal, treat it as software for review and experimentation, not for protecting real high-value secrets.

If you need to protect data at rest with a post-quantum outlook and an auditable format, let's talk.