pqkeygen

A small, dependency-light ssh-keygen-equivalent for the post-quantum signature transition. pqkeygen generates, stores, and exports ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) keypairs in formats that slot directly into the places SSH, TLS, and git already expect keys today.

Positioning

• Not a wrapper around OpenSSL providers — that space is covered by OpenSSL-provider-based tools (e.g. PQC-Key-Generator), which require a matching OpenSSL build.
• Not blockchain-scoped key tooling.
• Is a single static binary with no OpenSSL dependency, using pure-Rust PQC crates, that produces drop-in-ready keys today and can adopt OpenSSH's native ML-DSA support once upstream ships it.

Why now

OpenSSH has no native ML-DSA keygen yet. Anyone wanting to be ready has to hand-roll OpenSSL provider incantations. A clean CLI that produces drop-in-ready keys has a real window before upstream closes the gap.

Scope (v1)

• pqkeygen new --alg ml-dsa-65|ml-dsa-87|slh-dsa-sha2-128s ... — generate a keypair
• Output formats: raw FIPS 204/205 bytes, PEM (SPKI/PKCS8), and an OpenSSH-authorized_keys-compatible line (pq-ssh-ml-dsa-65 <base64> comment) — the differentiator, since nothing else formats PQ keys the way authorized_keys expects.
• pqkeygen fingerprint — SHA256 fingerprint, same display convention as ssh-keygen -lf
• pqkeygen convert — between PEM/DER/raw/OpenSSH-line formats
• Local key store: ~/.pqkeygen/ mirroring ~/.ssh/ layout (id_mldsa65, id_mldsa65.pub)
• --comment, --passphrase (encrypt private key at rest: PBKDF2 + AES-256-GCM or ChaCha20-Poly1305)

Explicitly out of scope for v1

• Signing/verifying — that's pqsign's job, not rebuilt here
• TLS certificate issuance
• HSM integration

See docs/DESIGN.md for architecture notes and docs/ROADMAP.md for milestones.

Stack

• Rust, single static binary
• pqcrypto (or liboqs-rust) bindings for ML-DSA / SLH-DSA
• zeroize for key material hygiene
• clap for the CLI
• Pure-Rust PQC crates preferred — no OpenSSL dependency

Status

Planning phase. No implementation yet — see the roadmap for milestone order.

License

MIT — see LICENSE.