README

QuantumShield — Post-Quantum Cryptography for Delphi

Delphi components for post-quantum cryptography (PQC). ML-KEM, ML-DSA and SLH-DSA key encapsulation and digital signatures via Windows CNG, OpenSSL 3.5 and liboqs. Delphi 7 to Delphi 13 compatible. NIST FIPS 203, FIPS 204, FIPS 205 compliant. Designed for ICP-Brasil V12 migration (IN ITI 35/2026). Community Edition — free and open-source (MPL 2.0).

English | Portugues

What is QuantumShield?

QuantumShield is a free, open-source Delphi component library for post-quantum cryptography (PQC). It enables Delphi developers to add quantum-resistant key exchange (ML-KEM / FIPS 203), digital signatures (ML-DSA / FIPS 204) and hash-based signatures (SLH-DSA / FIPS 205) to their applications — from legacy Delphi 7 ERPs to modern Delphi 13 projects.

Built specifically for the Brazilian market, QuantumShield addresses the mandatory PQC migration imposed by ICP-Brasil IN ITI 35/2026, which requires all digital certification systems to support ML-DSA and ML-KEM by March 2029.

It wraps three cryptographic backends — Windows CNG (Win11 24H2+), OpenSSL 3.5, and liboqs — behind a single IQSCryptoProvider interface with automatic backend selection. No code changes needed when switching backends.

Supported Algorithms

18 algorithms total, all with keygen, sign/verify (signatures) or encap/decap (KEM).

Quick Start

uses
  QS_Core_Types, QS_Core_Interfaces, QS_Infra_ProviderFactory;

var
  Prov: IQSCryptoProvider;
  KP: TQSKeyPair;
  Sig: TQSSignature;
  Msg, Ctx: TQSBytes;
begin
  // Auto-selects best backend (CNG > OpenSSL > liboqs)
  Prov := TQSProviderFactory.CreateProviderFor(qsaMLDSA65);

  // Generate ML-DSA-65 keypair
  KP := Prov.SignatureGenerateKeyPair(qsaMLDSA65);
  try
    // Sign
    Msg := TQSBytes(nil);
    SetLength(Msg, 11);
    Move(AnsiString('Hello PQC!')[1], Msg[0], 11);
    SetLength(Ctx, 0);

    Sig := Prov.Sign(KP.PrivateKey, Msg, Ctx);
    try
      // Verify
      Assert(Prov.Verify(KP.PublicKey, Msg, Sig, Ctx));
      WriteLn('Post-quantum signature verified!');
    finally
      Sig.Free;
    end;
  finally
    KP.Free;
  end;
end;

Installation

1. Install OpenSSL 3.5+

Download from slproweb.com (Win32 or Win64). Place libcrypto-3-x64.dll next to your EXE or on the system PATH.

On Windows 11 24H2+, ML-DSA works natively via CNG without OpenSSL.

2. Install QuantumShield packages

Delphi 7:

Open packages/D7/QSCore_D7.dpk ??? Install
Open packages/D7/QSProviderOpenSSL_D7.dpk ??? Install
Open packages/D7/QSInfra_D7.dpk ??? Install

Delphi 10+:

Open packages/D10/QSCore.dpk ??? Install
Open packages/D10/QSProviderOpenSSL.dpk ??? Install
Open packages/D10/QSInfra.dpk ??? Install

3. Add to search path

Add src\Core, src\Providers\OpenSSL, src\Infrastructure, src\Services to your project search path.

What's Included (Community Edition)

What's in Professional & Enterprise

The following modules will be available in future paid editions:

Additional modules and commercial support plans coming soon.

Compatibility

Architecture

?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
???              Your Application               ???
?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
???  TQSSignerService  ???  TQSKeyExchangeService ???
?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
???          TQSProviderFactory (auto)          ???
?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
??? CNG      ??? OpenSSL 3.5  ??? liboqs            ???
??? (Win11)  ??? (any Win)    ??? (fallback)        ???
?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
???  ML-KEM-512/768/1024 ??? ML-DSA-44/65/87     ???
???  SLH-DSA (12 sets)   ???                     ???
?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Security

• Private keys live only inside IQSSecureBuffer with anti-DCE wipe (dynamic RtlSecureZeroMemory or XOR-sink fallback)
• Secret comparison via QSConstantTimeEquals (no early exit)
• All DLLs loaded dynamically via GetProcAddress — no external imports, no crash on missing DLLs
• Typed EQS* exceptions — never bare Exception
• Zero warnings, zero hints policy (Article IX of the project constitution)

Running Tests

# Delphi 7
Open tests\DUnit\QSTests_DUnit.dpr ??? Run

# NIST KAT vectors (requires vector download)
scripts\download-nist-vectors.bat
scripts\run-kats-for-release.bat

Documentation

Full documentation in Portuguese: docs/pt-BR/

• Getting Started (15 minutes)
• Migration RSA → ML-DSA
• Security Model
• Delphi 7 Guide
• ICP-Brasil Integration
• FAQ

License

Community Edition is licensed under the Mozilla Public License 2.0.

Commercial modules (XML Signer, CMS, ICP-Brasil, Hybrid, TLS, VCL Components) will be available under a proprietary license.

Contributing

Contributions to the Community Edition are welcome. Please read the constitution before submitting a PR — it defines the 9 inviolable articles every contribution must respect (D7 baseline, dynamic loading, secure memory, typed exceptions, zero warnings, etc.).