pq-crystals.org

One-line Introduction

pq-crystals.org is an open-source project focused on the research, development, and standardization of Post-Quantum Cryptography (PQC) algorithms. Led by an international team of cryptography experts, its core outputs include CRYSTALS-Kyber and CRYSTALS-Dilithium, both of which have been selected by the U.S. National Institute of Standards and Technology (NIST) as post-quantum cryptography standards. Developers choose it because it provides reference implementations of encryption algorithms designed to resist attacks from quantum computers, making it a key foundation for future security migration.

Business Overview

pq-crystals.org is not a commercial company, but an academically driven open-source project. It mainly provides specification documents, reference implementation code, and test vectors for the CRYSTALS family of algorithms. Its history dates back to around 2016, when cryptographers from multiple European universities and research institutes jointly launched the CRYSTALS（Cryptographic Suite for Algebraic Lattices）project in response to the threat of quantum computing. In terms of industry standing, CRYSTALS-Kyber and CRYSTALS-Dilithium were formally designated by NIST in 2024 as post-quantum cryptography standards, making them a cornerstone of global cryptographic migration. Its main users include cryptography researchers, cybersecurity engineers, hardware security module（HSM）vendors, and enterprise developers preparing for quantum-resistant encryption. The project itself does not offer paid services, but its algorithm implementations are widely integrated into mainstream cryptographic libraries such as OpenSSL and liboqs.

Who It’s For

• Cryptography researchers: Need reference implementations to validate algorithm performance or conduct further development.
• Enterprise security teams: Evaluating or migrating to post-quantum cryptographic systems and needing to test algorithm compatibility.
• Hardware developers: For example, teams designing chips or IoT devices with PQC support that require lightweight implementations.
• Academic and educational use cases: Useful as teaching material in university cryptography courses covering quantum-resistant encryption principles.

Not suitable for: ordinary users or non-technical teams, as the project does not provide a graphical interface or one-click deployment tools; enterprises seeking commercial-grade technical support, because the open-source project does not offer any SLA guarantees.

Key Features and Highlights

• NIST-standard algorithms: CRYSTALS-Kyber（key encapsulation mechanism）and CRYSTALS-Dilithium（digital signature）are both NIST-selected standards, providing strong future compatibility.
• Open-source reference implementations: Provides reference code in C and Python, making it easier for developers to port and audit.
• Quantum-attack resistance: Based on lattice-based cryptography, designed to withstand Shor’s algorithm attacks against RSA/ECC.
• Performance optimization: The algorithms are designed with computational efficiency in mind; Kyber’s key generation and encapsulation speeds are leading among similar schemes.
• Multi-platform support: The code can be compiled and run on Linux, Windows, macOS, and embedded systems.
• Active community: The GitHub repositories are continuously updated, with clear issue tracking and contribution guidelines.

Pricing Analysis

pq-crystals.org itself is completely free. All code and documentation are released under open licenses such as CC0 or Apache 2.0. As a result, its cost falls into the “zero-cost” category, offering extremely high value for money. However, if an enterprise needs commercial-grade support—such as custom optimization, security audits, or integration services—it will need to find a third-party consulting firm on its own, such as Kudelski Security or PQShield. These services are typically quoted per project and can range from several thousand to hundreds of thousands of dollars. There are no hidden fees, but there is also no refund guarantee, simply because there is no paid transaction in the first place.

How Chinese Users Can Use It

Network accessibility: Direct access from mainland China is generally smooth. The official website pq-crystals.org and GitHub repositories can both be accessed directly without a VPN. However, GitHub clone speeds may be affected by domestic network conditions, so using a mirror site such as gitclone.com or a proxy accelerator is recommended.

Payment methods: No payment is involved, so this is not a concern.

Whether a VPN is needed: Usually not required, but if GitHub access becomes unstable, it is worth preparing a backup option.

Domestic alternatives in China: China’s cryptography community also has similar projects, such as Shanghai Jiao Tong University’s lattice cryptography algorithm library and the Institute of Information Engineering, Chinese Academy of Sciences’ post-quantum cryptography algorithm evaluation platform. However, pq-crystals is an international standard, while domestic projects are mostly used for academic research; commercial integration still mainly centers on pq-crystals.

Invoice issues: Since the project does not charge fees, it cannot provide invoices. If reimbursement documentation is required, users may try contacting NIST or relevant academic institutions, such as KU Leuven in Belgium, for a donation receipt, but the process is complex.

Pros and Cons

Pros:

• ✅ Algorithms standardized by NIST, offering strong long-term compatibility
• ✅ Completely open-source and free, with no licensing restrictions
• ✅ High-quality code, extensively validated by academia and industry
• ✅ Excellent performance, suitable for resource-constrained devices
• ✅ Active community and detailed documentation

Cons:

• ❌ No commercial support; issues must be resolved independently or through the community
• ❌ No packaged tools or API provided, making integration relatively demanding
• ❌ GitHub access from mainland China may be unstable
• ❌ Cannot issue invoices, making it less suitable for enterprise users requiring reimbursement
• ❌ Provides reference implementations only; production environments require additional optimization and hardening

Comparison with Similar Products

• liboqs（Open Quantum Safe project）: Provides a broader collection of post-quantum algorithms, including Kyber and Dilithium, packaged behind a unified API. pq-crystals is part of liboqs, but liboqs is more of an integration toolkit, while pq-crystals is the algorithm source.
• NIST PQC candidate algorithms（such as Falcon and SPHINCS+）: Also standardized by NIST, but Falcon is based on a different lattice construction（NTRU）, while SPHINCS+ is based on hash-based signatures. pq-crystals offers a more balanced profile in terms of performance and key size.
• Chinese commercial cryptography algorithms（such as SM2/SM9）: Mainly serve domestic compliance requirements and are not quantum-resistant. pq-crystals targets future threats, so the two have different positioning.

Final Recommendation

Best for: Developers conducting early research into post-quantum cryptography migration for existing systems, cryptography course teaching, and algorithm validation for academic papers. It is recommended to download the reference implementations directly from GitHub for testing, with no payment required.

Not suitable for: Enterprises needing plug-and-play solutions, individual developers without a cryptography background, and projects requiring commercial-grade SLAs or invoices. In these cases, commercial products such as IBM Quantum Safe or ISARA Radiate may be more appropriate.

Recommendation: Start by reading the specification documents on the pq-crystals official website or GitHub, run the sample code with Python scripts, and then decide whether to integrate it into a production environment. Since the algorithms have already been standardized, migrating early can reduce future compliance risks.