This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
Product upvotes vs the next 3
Waiting for data. Loading
Product comments vs the next 3
Waiting for data. Loading
Product upvote speed vs the next 3
Waiting for data. Loading
Product upvotes and comments
Waiting for data. Loading
Product vs the next 3
Loading
Post-Quantum Pretty Good Privacy PQ-PGP
Composite post-quantum cryptography in accordance RFC 9980
The mandatory combination of lattice-based algorithms (ML-KEM and ML-DSA) with classical elliptic curves guarantees total protection. The data remains protected both against tomorrow's quantum computers and against unknown mathematical weaknesses in the new algorithms.
PQ-PGP is a self-contained browser application that implements composite post-quantum OpenPGP cryptography in accordance with RFC 9980. The application pairs a NIST-standardised lattice-based primitive (ML-KEM from FIPS 203, ML-DSA from FIPS 204) with a classical elliptic-curve primitive (X25519 or X448 for ECDH, Ed25519 or Ed448 for EdDSA) at each cryptographic operation, deriving the wrapping key from both legs via the HKDF-SHA256.
Introduction: the quantum era of PGP Post-Quantum PGP (Pretty Good Privacy) represents the evolution of the email and file encryption standard to resist the threat of future quantum computers, which will be able to break traditional asymmetric algorithms — such as RSA and ECC — via Shor's algorithm. This technological transition is not a simple cipher upgrade; it is a complete architectural reworking of how OpenPGP derives keys, signs messages, and protects private keys at rest.
The transition is officially defined at a global level by the IETF standard RFC 9980 (Post-Quantum Cryptography in OpenPGP), published in mid-2026 as a Proposed Standard, which extends the recent Crypto Refresh of the OpenPGP standard (RFC 9580). The document defines composite schemes based on ML-KEM (formerly CRYSTALS-Kyber, FIPS 203) for encryption and ML-DSA (formerly CRYSTALS-Dilithium, FIPS 204) for signatures, paired with classical elliptic curves, as well as SLH-DSA (formerly SPHINCS+, FIPS 205) as an ultra-conservative standalone signature scheme.
Technical architecture: the PQ/T hybrid approach Because post-quantum algorithms are relatively new compared to decades of cryptanalysis on RSA and ECC, the cryptographic community has adopted a Post-Quantum / Traditional (PQ/T) hybrid strategy, also known as a composite construction. The fundamental principle is combined security: a message remains safe as long as at least one of the two algorithms — the classical one or the post-quantum one — remains unbroken. This hedge protects simultaneously against the future quantum computer and against unknown mathematical weaknesses in the new lattice-based algorithms.
Message encryption (composite KEM) To protect data in transit from the Harvest Now, Decrypt Later attack — intercepting encrypted data today to decrypt it in the future with a quantum computer — OpenPGP introduces composite schemes based on ML-KEM combined with elliptic curves. The process has three phases: • 1) an ephemeral symmetric session key is generated using AES-256; • 2) this key is encapsulated twice — once with the classical algorithm and once with the post-quantum one; • 3) the two outputs are cryptographically combined via SHA-256-based KDFs.
The mandatory and recommended combinations defined in RFC 9980 are: ➤ MUST: ML-KEM-768 + X25519 (Algorithm ID 35) — NIST Level 3, equivalent to AES-192. ➤ SHOULD: ML-KEM-1024 + X448 (Algorithm ID 36) — NIST Level 5, equivalent to AES-256, for ultra-sensitive long-term data.
Digital signatures (authentication and integrity) To ensure that the sender's identity cannot be forged by a quantum computer, signatures use the ML-DSA standard (FIPS 204) in composite mode, or SLH-DSA (FIPS 205) in standalone mode. In composite signatures, the application must successfully verify both signatures — the classical and the post-quantum one — to consider the message valid. SLH-DSA is instead used alone: its security relies solely on hash trees, and is therefore considered ultra-secure, but with very large signatures (7–30 KB) and high signing times.
➤ MUST: ML-DSA-65 + Ed25519 (Algorithm ID 30) — NIST Level 3. ➤ SHOULD: ML-DSA-87 + Ed448 (Algorithm ID 31) — NIST Level 5, required by CNSA 2.0 fornational-security systems. ➤ Standalone (optional): SLH-DSA-128s, SLH-DSA-128f, SLH-DSA-256s — based solely on hash functions, ideal for long-term trust anchors.
NIST SP 800-38F: AES Key Wrap for symmetric keys The relationship between the OpenPGP v6 / Post-Quantum ecosystem (RFC 9580 / RFC 9980) and the NIST SP 800-38F protocol (AES Key Wrap) focuses on a hyper-specific task: the encapsulation and protection of private symmetric keys within data packets. While AEAD modes (GCM, OCB, EAX) encrypt the message body, the NIST SP 800-38F standard intervenes one step earlier, acting as a security shield for the keys themselves.
The specification defines AES-based Key Wrapping methods (KW and KWP): a form of authenticated encryption specifically designed to protect high-entropy data (other cryptographic keys) rather than text streams. In OpenPGP v6 certificates this protocol is used in combination with Argon2id: • 1) the user enters the passphrase; • 2) Argon2id processes the passphrase and derives a symmetric Key Encryption Key (KEK); • 3) the software uses this KEK to decrypt the actual OpenPGP private key — classical or post-quantum — which is wrapped on disk using AES-KW / AES-KWP.
About Post-Quantum Pretty Good Privacy PQ-PGP on Product Hunt
“Composite post-quantum cryptography in accordance RFC 9980”
Post-Quantum Pretty Good Privacy PQ-PGP was submitted on Product Hunt and earned 2 upvotes and 1 comments, placing #136 on the daily leaderboard. The mandatory combination of lattice-based algorithms (ML-KEM and ML-DSA) with classical elliptic curves guarantees total protection. The data remains protected both against tomorrow's quantum computers and against unknown mathematical weaknesses in the new algorithms.
On the analytics side, Post-Quantum Pretty Good Privacy PQ-PGP competes within Encryption — topics that collectively have 747 followers on Product Hunt. The dashboard above tracks how Post-Quantum Pretty Good Privacy PQ-PGP performed against the three products that launched closest to it on the same day.
Who hunted Post-Quantum Pretty Good Privacy PQ-PGP?
Post-Quantum Pretty Good Privacy PQ-PGP was hunted by Aoi Asahina. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of Post-Quantum Pretty Good Privacy PQ-PGP including community comment highlights and product details, visit the product overview.
Aoi Asahina
PQ-PGP is a self-contained browser application that implements composite post-quantum OpenPGP cryptography in accordance with RFC 9980. The application pairs a NIST-standardised lattice-based primitive (ML-KEM from FIPS 203, ML-DSA from FIPS 204) with a classical elliptic-curve primitive (X25519 or X448 for ECDH, Ed25519 or Ed448 for EdDSA) at each cryptographic operation, deriving the wrapping key from both legs via the HKDF-SHA256.
Try it (WebApp): https://sh3lly.byethost11.com/pq-pgp
Technical Report: https://github.com/AoiAsahina/PQ-PGP/blob/main/PQ-PGP.pdf
Introduction: the quantum era of PGP
Post-Quantum PGP (Pretty Good Privacy) represents the evolution of the email and file encryption standard to resist the threat of future quantum computers, which will be able to break traditional asymmetric algorithms — such as RSA and ECC — via Shor's algorithm. This technological transition is not a simple cipher upgrade; it is a complete architectural reworking of how OpenPGP derives keys, signs messages, and protects private keys at rest.
The transition is officially defined at a global level by the IETF standard RFC 9980 (Post-Quantum Cryptography in OpenPGP), published in mid-2026 as a Proposed Standard, which extends the recent Crypto Refresh of the OpenPGP standard (RFC 9580). The document defines composite schemes based on ML-KEM (formerly CRYSTALS-Kyber, FIPS 203) for encryption and ML-DSA (formerly CRYSTALS-Dilithium, FIPS 204) for signatures, paired with classical elliptic curves, as well as SLH-DSA (formerly SPHINCS+, FIPS 205) as an ultra-conservative standalone signature scheme.
Technical architecture: the PQ/T hybrid approach
Because post-quantum algorithms are relatively new compared to decades of cryptanalysis on RSA and ECC, the cryptographic community has adopted a Post-Quantum / Traditional (PQ/T) hybrid strategy, also known as a composite construction. The fundamental principle is combined security: a message remains safe as long as at least one of the two algorithms — the classical one or the post-quantum one — remains unbroken. This hedge protects simultaneously against the future quantum computer and against unknown mathematical weaknesses in the new lattice-based algorithms.
Message encryption (composite KEM)
To protect data in transit from the Harvest Now, Decrypt Later attack — intercepting encrypted data today to decrypt it in the future with a quantum computer — OpenPGP introduces composite schemes based on ML-KEM combined with elliptic curves. The process has three phases:
• 1) an ephemeral symmetric session key is generated using AES-256;
• 2) this key is encapsulated twice — once with the classical algorithm and once with the post-quantum one;
• 3) the two outputs are cryptographically combined via SHA-256-based KDFs.
The mandatory and recommended combinations defined in RFC 9980 are:
➤ MUST: ML-KEM-768 + X25519 (Algorithm ID 35) — NIST Level 3, equivalent to AES-192.
➤ SHOULD: ML-KEM-1024 + X448 (Algorithm ID 36) — NIST Level 5, equivalent to AES-256, for ultra-sensitive long-term data.
Digital signatures (authentication and integrity)
To ensure that the sender's identity cannot be forged by a quantum computer, signatures use the ML-DSA standard (FIPS 204) in composite mode, or SLH-DSA (FIPS 205) in standalone mode. In composite signatures, the application must successfully verify both signatures — the classical and the post-quantum one — to consider the message valid. SLH-DSA is instead used alone: its security relies solely on hash trees, and is therefore considered ultra-secure, but with very large signatures (7–30 KB) and high signing times.
➤ MUST: ML-DSA-65 + Ed25519 (Algorithm ID 30) — NIST Level 3.
➤ SHOULD: ML-DSA-87 + Ed448 (Algorithm ID 31) — NIST Level 5, required by CNSA 2.0 fornational-security systems.
➤ Standalone (optional): SLH-DSA-128s, SLH-DSA-128f, SLH-DSA-256s — based solely on hash functions, ideal for long-term trust anchors.
NIST SP 800-38F: AES Key Wrap for symmetric keys
The relationship between the OpenPGP v6 / Post-Quantum ecosystem (RFC 9580 / RFC 9980) and the NIST SP 800-38F protocol (AES Key Wrap) focuses on a hyper-specific task: the encapsulation and protection of private symmetric keys within data packets. While AEAD modes (GCM, OCB, EAX) encrypt the message body, the NIST SP 800-38F standard intervenes one step earlier, acting as a security shield for the keys themselves.
The specification defines AES-based Key Wrapping methods (KW and KWP): a form of authenticated encryption specifically designed to protect high-entropy data (other cryptographic keys) rather than text streams. In OpenPGP v6 certificates this protocol is used in combination with Argon2id:
• 1) the user enters the passphrase;
• 2) Argon2id processes the passphrase and derives a symmetric Key Encryption Key (KEK);
• 3) the software uses this KEK to decrypt the actual OpenPGP private key — classical or post-quantum — which is wrapped on disk using AES-KW / AES-KWP.