Quantum-enhanced Argon2 with a dash of real qubits. The library fetches ten bytes of entropy from AWS Braket and folds them into the salt before running a classic Argon2 hash. The approach increases the cost of large-scale offline attacks, though it is not a post‑quantum scheme.
This project demonstrates a minimal "quantum stretch". A tiny circuit runs on managed quantum hardware or the simulator and returns ten truly random bytes. These bytes are appended to your chosen salt and fed into a normal Argon2 hashing step. The extra call to Braket raises the attacker's cost because each password guess must repeat the service call.
Security Notice The quantum stretch slows classical brute force attempts but offers no resistance once large fault‑tolerant quantum computers exist.
The library derives randomness from a short circuit applying Hadamard gates to eight qubits and measuring the result. Each shot yields one byte of entropy. See docs/quantum-circuit.md for a step-by-step explanation.
pip install .
python -m qs_kdf hash mypassword --salt deadbeefcafebabe
# or let the CLI pick a salt for you
python -m qs_kdf hash mypasswordpython -m qs_kdf hash "mypassword" --salt deadbeefcafebabeWhen no salt is provided the CLI prints the generated salt and digest separated by a space. The salt must be saved for verification.
$ python -m qs_kdf hash mypassword
0123456789abcdef0123456789abcdef deadbeef...Running without --cloud keeps all computation local using the built-in
simulator backend.
Set QS_WARMUP=1 or call qs_kdf.warm_up() to preload Argon2 memory
for consistent benchmarking.
The pepper in src/qs_kdf/constants.py is
included only so the examples run out of the box. Local hashing fails
unless QS_PEPPER is set to a 32-byte secret. Export your own value
before invoking the CLI. See
docs/getting-started.md lines 55-57 and 67 for
instructions on overriding QS_PEPPER. Always set a unique 32-byte
secret in any production environment.
The BraketBackend defaults to the IonQ QPU but accepts a device_arn
parameter if you wish to target a different device.
The stack in infra/qs_kdf_stack.py can be deployed
with a single command:
cd infra && cdk deployVerify:
python -m qs_kdf verify "mypassword" --salt deadbeefcafebabe --digest <hex>Running without --cloud keeps everything local using the built-in simulator. For a deeper walkthrough see docs/getting-started.md.
The stack in infra/qs_kdf_stack.py deploys the Lambda function, KMS key and supporting resources. Validate locally:
cd infra
cdk synthDeploy with cdk deploy or use the included Terraform module:
terraform -chdir=terraform applyMore background is available in the documents under docs/.
See docs/lambda-build.md for instructions on
packaging the Lambda function.
See docs/deployment.md for AWS setup and
deployment steps.
Use Python 3.10 or newer. Install the hooks once:
pre-commit installRun the hooks and tests before committing:
pre-commit run --files <files>
pip install -r requirements.txt -r requirements-dev.txt
pytestMissing packages such as argon2-cffi will cause test failures.
Extra checks such as mypy or bandit are optional but recommended.
This project is licensed under the MIT License. See LICENSE for details.