Cryptographic Primitives and Parameter Sets

The master table

Source citations for every row live in docs/SPEC/01-primitives.md §2.1, each pointing into crypto-core/src/.

Backend pinning

Every ML-KEM and ML-DSA operation dispatches to a library lineage holding FIPS 140-3 certificate #4631. QERYX's own module boundary is not yet CMVP-certified; module validation is in progress. Two unmaintained third-party PQ crates were removed in the 2026-04 migration for concrete reasons:

• The KyberSlash timing attacks (IACR ePrint 2024/1049; TCHES 2025) recover ML-KEM private keys in minutes on unpatched reference implementations — one removed crate tracked reference C that was never patched past the 2023-12-29 disclosure.
• The other shipped a round-3 signature variant rather than the final FIPS 204 ML-DSA parameterization.
• The pinned backend's ML-KEM kernels are audited secret-independent, and its ML-DSA signs hedged by default per FIPS 204 Appendix D.

Level 5 parameter sets

Both lattice primitives run at NIST security category 5 — the only category CNSA 2.0 accepts for National Security Systems.

Deterministic ML-DSA signing is never used on mobile: FIPS 204 warns the deterministic variant is vulnerable to fault-injection differential attacks. Every signature draws fresh 256-bit randomness.

Context framing — FIPS 204 §5.2, load-bearing

Every ML-DSA-87 signature in QERYX carries an explicit context string, framed exactly as the standard specifies:

M' = 0x00 || len(ctx) || ctx || M

Every byte of the context is signed. A signature computed under context A deterministically fails verification under context B — there is no cross-protocol replay. Fifteen reserved context strings cover the protocol slots, one each: message authentication, handshake transcript, device pairing, build attestation, both ESv1 legs, call initiation, the pre-key handshake, KTS tree heads and leaves, FSOR destruction roots, destruction proofs, and the three QLEAP directory slots. The full table with citations is in the source chapter.

Labeled HKDF

labeled_hkdf(IKM, label, context, len):
    info = "QERYX-v1-" || label || context
    return HKDF-SHA-512(IKM, salt = None, info, len)

The "QERYX-v1-" prefix is wire-stable; bumping it is a session-state break. A boundary-collision-safe variant (labeled_hkdf_strict) injects a reserved delimiter byte between label and context for new protocol slots; existing slots stay byte-locked for forward compatibility — an external review finding (F-005) closed with exactly this split. The full label catalog ships in the Reviewer FAQ.

Argon2id

Memory      = 512 MiB
Iterations  = 2
Parallelism = 4
Output      = 32 B
Salt        = 16 B random per call

The 2026-05-01 audit reweighting moved the one-shot path up from the RFC 9106 second recommendation (64 MiB · t=3) to 512 MiB · t=2 — a 5.3× increase in memory-iterations work factor. The RFC 9106 first recommendation (2 GiB · t=1) remains exposed as a named constant for desktop tooling; phone processes cannot run it under the per-process memory ceiling.

What is deliberately absent

Each absence below is a decision with a reason attached. Nothing here was left out because including it was inconvenient.

• No ECDSA or RSA classical signatures anywhere in the message path. CNSA 2.0 requires ML-DSA-87 for software and firmware signing by 2027; QERYX is already there.
• No ML-DSA-65 fallback. Removed 2026-04-20 per an external audit — there is no negotiation variable to downgrade.
• No Curve25519 EdDSA in the identity path — X25519 is key exchange only; identity signatures are ML-DSA-87.
• No SHA-1, no MD5, anywhere in the dependency tree.

References

1. QERYX Protocol Specification §2 — docs/SPEC/01-primitives.md, snapshot 2026-05-01.
2. NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), 2024.
3. RFC 5869 (HKDF), RFC 7748 (X25519), RFC 8439 (ChaCha20-Poly1305), RFC 9106 (Argon2).
4. KyberSlash: division timing attacks on ML-KEM reference code — IACR ePrint 2024/1049.
5. CNSA 2.0 and FIPS Conformance Posture — the per-line conformance mapping for this table.