Post-quantum cryptographic utilities for the Quantova network.
@quantova/common is the low-level toolkit that lets applications speak to the
Quantova chain securely in a post-quantum world. It provides the building blocks
for key handling, address derivation, transaction signing, hashing, and encoding,
and is the foundation the Quantova SDK, the Qmask.io
wallet, and the Qdock.io IDE build on.
Its defining feature is a complete set of NIST post-quantum signature
primitives — CRYSTALS-Dilithium, Falcon, and SPHINCS+ — together
with the Quantova signature envelope (qsignature) used to construct and
verify Quantova transactions. These are the same three schemes the Quantova
protocol uses at the account layer, so keys, addresses, and signatures produced
here are valid on the Quantova network.
Quantova accounts are secured from the signature layer up by post-quantum
cryptography. This library is where that begins on the client side: every
Q-address, every signed transaction, and every signature verification in the
Quantova toolchain flows through the primitives implemented here.
At a glance, the integration provides:
- Three post-quantum signature schemes — Dilithium, Falcon, and SPHINCS+ — exposed through a consistent key-pair, sign, and verify interface.
- The Quantova signature envelope (
qsignature) — the canonical structure that binds a signature to its scheme identifier and public key, exactly as the Quantova runtime expects it on the wire. - Canonical
Q-address derivation — addresses derived from the SHA3-256 digest of a post-quantum public key, in the brandedQform used across the wallet, explorers, and RPC. - Hierarchical key derivation for post-quantum keys, so wallets can manage accounts deterministically.
Everything is wired so the higher-level @quantova SDK, Qmask.io, and Qdock.io
can generate keys, derive addresses, and sign and verify Quantova transactions
without re-implementing any cryptography.
Beyond the general-purpose utilities, Quantova has added and maintains the following components in this repository.
A dedicated module per NIST scheme, each with a uniform surface — key-pair
creation from a seed, hard key derivation, signing, verification, the bridge into
the shared keyring interface, and the qsignature envelope:
- CRYSTALS-Dilithium —
util-crypto/src/dilithium(lattice-based; the general-purpose Quantova signature scheme). - Falcon —
util-crypto/src/falcon(compact lattice-based signatures for size-sensitive transaction authorisation). - SPHINCS+ (SLH-DSA) —
util-crypto/src/sphincsp(stateless hash-based signatures for the highest conservative security margin).
Each module exposes pair (key generation), sign, verify, deriveHard,
bridge, and qsignature so the three schemes are interchangeable behind one
API.
The qsignature helpers package a raw post-quantum signature together with its
scheme identifier and public key, producing the exact envelope the
Quantova runtime verifies. The scheme tag follows the protocol's ordering
(SPHINCS+, Falcon, Dilithium), so an envelope produced here is self-describing
and chain-ready.
A dedicated workspace package that ships Falcon as high-performance WebAssembly:
- A native Rust implementation (
native/src/lib.rs) of the Falcon scheme. - Prebuilt browser (
src/generated) and Node.js (src/generated-node) WASM bundles, with automatic environment detection so the right build loads in each runtime.
This lets Falcon signing and verification run at near-native speed in both the browser (wallets, dApps) and server environments.
The post-quantum schemes are bridged into the keyring and key-derivation layer
(including hard derivation and the Falcon HD path), so accounts created in the
Quantova toolchain produce canonical Q-addresses and sign with their chosen
post-quantum scheme through the standard account interface.
SHA3-256 hashing and the hex/byte encoding helpers used throughout are aligned with Quantova's conventions, so payloads constructed client-side match what the node expects.
In practice, downstream Quantova software pulls a small, well-defined set of capabilities from this library to interact with the chain:
- Generating and handling post-quantum key pairs (Dilithium / Falcon / SPHINCS+).
- Deriving the canonical
Q-address for an account. - Producing and verifying the Quantova signature envelope for transactions.
- The hex/byte encoding helpers used when constructing and submitting payloads.
This is the layer that sits beneath the higher-level @quantova SDK, the Qmask.io
wallet, and the Qdock.io IDE.
The repository is organised as a set of internal packages (yarn workspaces).
Post-quantum packages
util-crypto— cryptographic and hashing utilities, including the Dilithium, Falcon, and SPHINCS+ modules and theqsignatureenvelope.quantova-falcon-wasm— the native Falcon scheme compiled to WebAssembly (browser + Node builds).
Core utilities
keyring— keyring and account management.util— general utilities (hex/byte conversions, BN, formatting, assertions).
This repo uses yarn workspaces, so after cloning, install dependencies with
yarn — not npm (npm will produce broken workspace dependencies).
Requirements:
- A recent Node.js (this project targets
>= 18.14). - A recent Yarn (Berry, v4+).
# 1. Clone
git clone https://github.com/Quantova/common.git
cd common
# 2. Install dependencies (yarn, not npm)
yarn
# 3. Build all packages
yarn buildAdditional scripts (lint, test, and others) are defined in
package.json.
Licensed under the Apache License, Version 2.0. See LICENSE for
the full text. Quantova's post-quantum additions and modifications are
© 2026 Quantova Inc, provided under the same license.
This project builds on @polkadot/common © Parity Technologies and the
polkadot-js authors, used under Apache-2.0; the original copyright and license
notices are retained, and we thank its maintainers for the foundational
utilities this library extends. "Polkadot" and "polkadot-js" are the property of
their respective owners and are referenced here for attribution only.
Quantova™, QTOV™, QVM™, Qmask.io™, and Qdock.io™ are trademarks of Quantova Inc.
© 2026 Quantova Inc