SPSDK PQC - Post-Quantum Crypto support for SPSDK

0.6.8 verified Fri May 01 auth: no python

A plugin for NXP's SPSDK that provides post-quantum cryptography support, including key generation, signing, and verification using algorithms like Dilithium, Falcon, and SPHINCS+. Current version 0.6.8, requires Python >=3.9. Released as part of SPSDK Plugins, with new versions approximately every 2-3 months.

pip install spsdk-pqc

Common errors

error ModuleNotFoundError: No module named 'spsdk.pqc' ↓

cause Old import path used; module was renamed to spsdk_pqc in version 0.6.0.

fix

Use 'from spsdk_pqc import PQCProvider' instead.

error OSError: liboqs.so: cannot open shared object file: No such file or directory ↓

cause liboqs C library is not installed on the system.

fix

Install liboqs: e.g., 'apt install liboqs-dev' or download from https://github.com/open-quantum-safe/liboqs.

Warnings

gotcha The library wraps liboqs, which must be installed separately or the Python package may fail at runtime with 'OQS library not found'. ↓

fix Install liboqs system-wide (e.g., apt install liboqs-dev) or use a precompiled wheel that bundles it.

breaking In SPSDK Plugins 3.0.0, the import path changed from spsdk.pqc to spsdk_pqc. Old imports will break. ↓

fix Change 'from spsdk.pqc import ...' to 'from spsdk_pqc import ...'

Imports

PQCProvider

wrong

from spsdk.pqc import PQCProvider

correct

from spsdk_pqc import PQCProvider

Old import path before SPSDK Plugins restructure

PQCSignature

wrong

from spsdk.pqc import PQCSignature

correct

from spsdk_pqc import PQCSignature

Old import path before SPSDK Plugins restructure

Quickstart

Initialize PQCProvider, generate a Dilithium2 key pair, sign a message, and verify the signature.

from spsdk_pqc import PQCProvider
from spsdk import SpsdkError

provider = PQCProvider()
# Generate a Dilithium2 key pair
private_key, public_key = provider.generate_keypair('Dilithium2')
print('Public key:', public_key.hex())
# Sign a message
message = b'Test message'
signature = provider.sign(private_key, message)
print('Signature:', signature.hex())
# Verify
is_valid = provider.verify(public_key, message, signature)
print('Verification:', is_valid)