Recently, Google announced an aggressive 2029 timeline for migrating to Post-Quantum Cryptography. Earlier today, Cloudflare announced that they're matching Google on a 2029 roadmap.

It's high time the PHP community took this threat seriously as well.

Last year, we proposed a roadmap for getting post-quantum cryptography in the PHP ecosystem. We received a lot of valuable feedback in the discussions that followed and decided to shift gears a little.

Today, we're releasing two open source projects to help PHP software mitigate the risk of a cryptography relevant quantum computer (CRQC).

ext-pqcrypto

ext-pqcrypto is a PHP extension in Rust, made possible by the ext-php-rs project. It wraps the RustCrypto post-quantum KEMs and digital signature algorithms for use in PHP software.

Once installed, it exposes a PQCrypto namespace.

<?php
if (!extension_loaded('pqcrypto')) {
    die('extension not loaded');
}
[$sk, $pk] = PQCrypto\XWing::generateKeypair();

[$sharedSecret, $ciphertext] = $pk->encapsulate();
$recipientSecret = $sk->decapsulate($ciphertext);

assert(hash_equals($recipientSecret, $sharedSecret));

As more community resources are focused on the RustCrypto implementations of these post-quantum algorithms (i.e., to improve performance and provide higher assurance for the implementations' correctness), our PHP extension will be updated in tandem with new releases. Therefore, the PHP community can benefit automatically from the cryptography engineering already taking place in the Rust ecosystem.

pqcrypto_compat

Installing a PHP extension isn't always an option for the installed base of the PHP programming language.

Many years ago, this observation motivated the creation of sodium_compat (a pure-PHP implementation of libsodium).

Similarly, we are developing pqcrypto_compat: a pure-PHP implementation of these post-quantum algorithms for systems that cannot install ext-pqcrypto. We currently ship all three ML-KEM parameter sets, all ML-DSA parameter sets, and the hybrid X-Wing KEM.

In accordance with the Zeroth Rule of PHP Cryptography, if the extension is installed, the Compat API will prefer the Rust implementation.

<?php
declare(strict_types=1);
use ParagonIE\PQCrypto\Compat;

// Key generation
[$decapsKey, $encapsKey] = Compat::xwing_keygen();

// Encapsulation
['sharedKey' => $ss, 'ciphertext' => $ct] = Compat::xwing_encaps($encapsKey);

// Decapsulation
$sharedKey = Compat::xwing_decaps($decapsKey, $ct);
var_dump(hash_equals($ss, $sharedKey)); // bool(true)

Closing Thoughts

We are not yet "pencils down" on this software. There will be bugs. Don't rush to deploy this into production yet.

With those caveats in mind, we hope by making these algorithms to the PHP community, we can all be ready to switch by the year 2029. The only way to get there is to start working on the migration today.