INFO: PQC plugins: ML-KEM and ML-DSA

PQC plugins: ML-KEM and ML-DSA

Suitable as external plugins for Rebex libraries based on Rebex SSH and Rebex TLS.

Overview

Migration to post-quantum cryptography is in full swing, but not all target systems support ML-KEM and ML-DSA algorithm yet.

Additionally, not all systems support X25519 or another elliptic curve Diffie-Hellman named group, which is used together with ML-KEM in hybrid ciphers in both TLS 1.3 and SSH.

Licensing

These libraries build upon various open-source projects and are licensed under various open-source licenses. See the table below for details.

Libraries

Assembly	Elliptic curve algorithms	Required on	Based on	License
`Rebex.PQC.Castle.dll`	Hybrid ML-KEM + ECDH ML-DSA	Required on Windows 10 or earlier, on other systems with no ML-KEM or ML-DSA support in .NET.	Bouncy Castle C# API by The Legion of the Bouncy Castle	Adaptation of MIT X11 License
`Rebex.Curve25519.dll`	Hybrid ML-KEM + ECDH with X25519	Required on Windows 8.1 or earlier and on other systems with no X25519 support in .NET.	C# implementation of Curve25519 by Hans Wolff, Dmitry Skiba and Matthijs van Duin	Apache License 2.0
`Rebex.Castle.dll`	Hybrid ML-KEM + ECDH with NIST P-256 Hybrid ML-KEM + ECDH with NIST P-384	Required on Windows 8.1 or earlier for SSH; on Windows XP for TLS, or on other systems with no NIST curve support in .NET.	Bouncy Castle C# API by The Legion of the Bouncy Castle	Adaptation of MIT X11 License

Using PQC plugins with Rebex libraries

To use these plugins with Rebex libraries version 8.0 or higher, just reference suitable NuGet packages and register desired plugins:

C#

using Rebex.Security.Cryptography;
...

// register ML-KEM plugin
AsymmetricKeyAlgorithm.Register(MLKem.Create);

// register ML-DSA plugin
AsymmetricKeyAlgorithm.Register(MLDsa.Create);

// register NIST curves plugin
AsymmetricKeyAlgorithm.Register(EllipticCurveAlgorithm.Create);

// register X25519 curve plugin
AsymmetricKeyAlgorithm.Register(Curve25519.Create);

VB.NET

Imports Rebex.Security.Cryptography
...

' register ML-KEM plugin
AsymmetricKeyAlgorithm.Register(AddressOf MLKem.Create)

' register ML-DSA plugin
AsymmetricKeyAlgorithm.Register(AddressOf MLDsa.Create)

' register NIST curves plugin
AsymmetricKeyAlgorithm.Register(AddressOf EllipticCurveAlgorithm.Create)

' register X25519 curve plugin
AsymmetricKeyAlgorithm.Register(AddressOf Curve25519.Create)

Note: Registered plugins are ignored when FIPS-only mode is enabled.

A registered plugin takes precedence over the built-in implementation. Therefore, it is recommended to check whether the required algorithms are already supported before registering any plugins. The following examples show how to perform the availability check for various categories of algorithms.

Detecting PQC support

To check for PQC support and optionally register PQC plugins, use this code:

// register plugin for ML-DSA and ML-KEM if not already supported
if (AsymmetricKeyAlgorithm.IsSupported(AsymmetricKeyAlgorithmId.MLDsa, "mldsa44", 0))
{
    AsymmetricKeyAlgorithm.Register(MLKem.Create);
    AsymmetricKeyAlgorithm.Register(MLDsa.Create);
}

If you need support for composite PQC key exchange ciphers based on X25519, and target operating systems other than Windows 10/11, make sure to enable X25519 plugin as well:

// register plugin for X25519 plugin if not already supported
if (AsymmetricKeyAlgorithm.IsSupported(AsymmetricKeyAlgorithmId.ECDH, "x25519", 0))

    AsymmetricKeyAlgorithm.Register(Curve25519.Create);
}

Additionally, if you still need to target Windows 8.1, Mono, Xamarin, or legacy operating systems, and wish to use composite PQC ciphers based on ECDH or ECDSA, then use elliptic curve plugin:

// register plugin for ECDH and ECDSA with NIST-P curves if not already supported
if (AsymmetricKeyAlgorithm.IsSupported(AsymmetricKeyAlgorithmId.ECDH, "secp256r1", 0))
{
    AsymmetricKeyAlgorithm.Register(EllipticCurveAlgorithm.Create);
}

Changelog

2026-06-24 - v1.0.29 - First version of PQC plugins released.

Send us feedback

Do you have any comments, questions or suggestions? Let us know at Rebex support forum or contact us.