Skip to content
AegisQ

Hybrid encryption.A clear Python path.

AegisQ pairs ML-KEM key encapsulation with AES-256-GCM authenticated encryption through a Python API backed by a Rust core.

Open the docs

Your first roundtrip

from aegisq import AegisCipher


cipher = AegisCipher()
keypair = cipher.generate_keypair()


package = cipher.encrypt(b"Hello, AegisQ", keypair.public_key)
plaintext = cipher.decrypt(package, keypair.secret_key)
assert plaintext == b"Hello, AegisQ"

Installation

Terminal window
python -m pip install aegisq-pqc

Python 3.11 or later. ML-KEM-768 by default.

One package. Four ordered parts.
  1. ML-KEM capsuleKey encapsulation
  2. AES nonce12 bytes
  3. Auth tag16 bytes
  4. CiphertextEncrypted payload

One-shot Transit Package format. Illustration is not to scale in bytes.

Understand the hybrid design

The sender encrypts with the recipient’s public key; the recipient keeps the secret key private. Obtain public keys through a trusted channel. The example uses one keypair locally; AES-GCM does not establish the sender’s identity.

Continue with the quick start

Find Your Workflow

Section titled “Find Your Workflow”

Encrypt data

Section titled “Encrypt data”

Start with AegisCipher and KeyPair. Choose a security level and inspect the exception hierarchy. MlKem exposes raw KEM operations for advanced protocols.

Work with files and asyncio

Section titled “Work with files and asyncio”

Streaming processes data in chunks; memory use depends on input chunking. Async methods offload encryption and decryption to a thread pool; key generation stays synchronous. Key serialization covers PEM, JSON, and encrypted persistence with high-entropy wrapping secrets.

Understand key lifetimes and security

Section titled “Understand key lifetimes and security”

Ephemeral sessions and the context manager provide lifecycle helpers, not complete erasure or forward-secrecy guarantees. Selected Rust buffers are zeroized; caller-owned Python bytes and all key copies are not covered.

Read the architecture, hybrid KEM-DEM flow, and mathematical foundation for implementation details. Native operations release the GIL with py.detach(). The PEP 561 marker and native stubs support tooling, but streaming bindings are not yet included in the stub.

NIST vector tests cover KeyGen and encapsulation outputs; this is not official ACVP validation. The FIPS 203 reference and glossary explain the standard and terminology. Timing defenses are not a complete side-channel audit.