Prepare for post-quantum and FIPS

You will inventory your cryptography and move one signature to a post-quantum algorithm. It takes about 30 minutes.

You need

• Node 24 or newer for ML-DSA and ML-KEM. Run pqAvailable("ML-DSA-65") to ask a platform; one without it fails with MAIN-CRYPTO-0010 and nothing is substituted.

1. Inventory what the app uses

Run mainsdk cbom. It scans your source for algorithm names and writes a CycloneDX 1.6 CBOM. quantumVulnerable lists the components that a quantum computer would break, such as RSA and ECDSA.

2. Sign with ML-DSA and exchange keys with a hybrid

pqGenerateKeyPair, pqSign and pqVerify use ML-DSA. hybridGenerate, hybridEncapsulate and hybridDecapsulate join X25519 and ML-KEM-768 so an attacker has to break both. Pass an AlgorithmInventory to have each use recorded.

3. Turn on FIPS mode

crypto:
  fips: true
  module: { name: Acme Crypto Module, version: "3.0.9", certificate: "<CMVP certificate number, 3 to 5 digits>" }

mainsdk check fails with MAIN-CRYPTO-0013 when module is missing or its certificate is not a number of 3 to 5 digits. In FIPS mode, a call for an unapproved algorithm fails with MAIN-CRYPTO-0011, and a platform without a validated provider fails with MAIN-CRYPTO-0012. MainSDK never writes a certificate number for you; it comes from your module's validation.

Check that it works

• mainsdk cbom --json lists your algorithms and marks the vulnerable ones.
• Verify a signature after changing one byte: it returns false.