skills.rest
nbiish
nbiishCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pqc-signatures-security

Implement and verify ML-DSA-65 post-quantum signatures for repository code integrity.

Updated Sep 2, 2026
Search Tags:#signature verification#code signing#supply chain security#openssl#post-quantum cryptography#ml-dsa-65#fips 204
One-click install
npx skills add https://github.com/nbiish/tts-mcp --skill pqc-signatures-security-nbiish
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pqc-signatures-security
Source: https://github.com/nbiish/tts-mcp/tree/main/.agents/skills/pqc-signatures-security
Command: npx skills add https://github.com/nbiish/tts-mcp --skill pqc-signatures-security-nbiish

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Classical signature algorithms like RSA, ECDSA, and Ed25519 are vulnerable to future quantum attacks, leaving signed code and artifacts exposed to tampering. This Skill guides AI agents to implement NIST FIPS 204/205 post-quantum signature verification so repositories can detect code tampering and enforce fail-closed execution. ## Core Features & Use Cases - ML-DSA-65 Signing Infrastructure: Step-by-step blueprints for generating keypairs with OpenSSL 3.5+, signing files, and deploying verification scripts with git hooks. - Agent Integration Protocol: Auto-detection of public keys and signatures, structured audit logging, and fail-closed refusal when verification fails. - Secure Coding Patterns: Reference implementations for secrets redaction, path containment, parameterized subprocess spawning, and Argon2id password hashing. - Use Case: A maintainer wants to protect release artifacts against supply-chain tampering. The agent generates an ML-DSA-65 keypair, signs all distribution files, commits the public key to .pqc-keys/, and adds CI verification that rejects any artifact whose signature does not verify. ## Quick Start Ask the agent to set up ML-DSA-65 signature verification for this repository, including key generation, signing of shell scripts, and a git post-merge verification hook.

Frequently Asked Questions about pqc-signatures-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sign files with ML-DSA-65 post-quantum signatures?▼

Generate a keypair with OpenSSL 3.5+ using 'openssl genpkey -algorithm ML-DSA-65', then sign files with 'openssl pkeyutl -sign' or the pqc-sign CLI. Store the private key in a keychain or KMS and commit only the public key.

What is the difference between ML-DSA-65 and SLH-DSA signatures?▼

ML-DSA-65 is a lattice-based FIPS 204 algorithm with 1952-byte public keys and 3309-byte signatures, used as the primary signing method. SLH-DSA is hash-based per FIPS 205 with larger 7856-byte signatures, recommended as a long-term backup since it relies only on hash security.

Does OpenSSL support ML-DSA without the oqs-provider?▼

Yes, OpenSSL 3.5+ includes native ML-KEM, ML-DSA, and SLH-DSA support, so the oqs-provider is no longer needed. The first CMVP ML-DSA module certificates were issued in March 2026.

Why should I not sign the hash of a file instead of the file itself?▼

Pre-hashing externally bypasses the algorithm's internal domain separation and can expose you to chosen-prefix collision attacks if the hash is weak. ML-DSA-65 and SLH-DSA handle internal hashing correctly, so sign the file contents directly.

What does post-quantum code signing not protect against?▼

Signing does not protect against compromise of the signing key itself, vulnerabilities inside the signed code, or a compromised verification binary on the consumer side. Mitigate with hardware key storage, key rotation, code review, and reproducible builds.

How do I verify signatures automatically in CI pipelines?▼

Add a CI step that installs pqc-sign and loops over all .sig files, running 'pqc-sign verify' against each corresponding input file. The command exits 0 on valid signatures and 1 on invalid or missing ones, failing the build automatically.

Related Skills

Explore More Software Engineering Skills→
adaptive-enforcement-labadaptive-enforcement-lab
3

phase-1-foundation-weeks-1-4

Enforce pre-commit secrets checks and branch protection across repositories.

Official
Intermediate
kortix-aikortix-ai

kortix-environment-secrets

Manage environment secrets and API keys across cloud and local runtimes.

Official
Advanced
mitchuskimitchuski

agentprivacy-key-ceremony

Manages key generation, rotation, delegation, and revocation ceremonies for 5G networks.

Community
Advanced
pangzhenying2025pangzhenying2025
7

automotive-quantum

Applies quantum computing algorithms to battery chemistry, crash simulation, V2X cryptography, and materials design.

Community
Advanced