Skip to content

Quantum Vault

2-of-3 Shamir · AES-256-GCM · SMAUG-T · HAETAE

Seals a secret under an AES-256-GCM key that is split 2-of-3 with Shamir, wraps each share with the SMAUG-T post-quantum KEM, and signs the container with HAETAE — so you can watch several primitives compose into one seal/open pipeline.

Demo boxes are pre-loaded. Use any 2 of 3 passwords to open:

Box Password 1 Password 2 Password 3
01 무궁화 태극기 한라산
03 ruby emerald diamond
04 거북선 첨성대 석굴암
06 fortress bastion citadel
07 봄바람 여름비 가을달
09 monday tuesday wednesday
Initializing KpqC modules (SMAUG-T + HAETAE)…

Vault — Safety Deposit Boxes

👉 Try it: click box 03 and enter any 2 of ruby / emerald / diamond to open it.

How this box works

Four cryptographic primitives compose into one seal. This is the envelope story, in order:

  1. 1 Your secret is locked with one random AES-256 key.
  2. 2 That key is split into 3 pieces — any 2 rebuild it exactly, 1 alone reveals nothing.
  3. 3 Each piece is sealed to one keyholder with a quantum-safe lock (SMAUG-T).
  4. 4 The whole box is signed (HAETAE) so any tampering is detected before it opens.

Inside step 3: two nested locks, not one

“A quantum-safe lock” is shorthand for two separate wrappings. The password and the KEM protect different things — collapsing them hides where the post-quantum guarantee actually lives.

  1. Layer 1 — your password Password → PBKDF2 (600k iters) → an AES key that unlocks this keyholder’s SMAUG-T secret key. This is the ONLY step your password touches.
  2. Layer 2 — the post-quantum KEM At seal time SMAUG-T encapsulated a random 32-byte shared secret against the keyholder’s public key. On open, decapsulate with the secret key recovers that same shared secret — the wrapping key that finally unlocks the Shamir share. THIS is the layer a quantum attacker can’t break.

So: crack the password and you still face the KEM; break the KEM (needs a quantum computer that doesn’t exist) and you still face the password. The share only appears when BOTH are peeled.

Why can’t a quantum computer break layer 2?

In 2-D, picking the lattice dot nearest the red target is trivial — you just look. SMAUG-T’s lattice has hundreds of dimensions, where “find the nearest point” (the Module-LWE problem) has no known efficient solution, classical OR quantum. That gap is the whole security guarantee.

New to these terms? Expand any for a plain-language definition:

What is a KEM?

KEM = Key Encapsulation Mechanism: a way for two parties to agree on a shared secret key using public-key crypto. Analogy: a self-locking mailbox — anyone can drop in a secret using your public slot, but only your private key opens it. SMAUG-T is a KEM a quantum computer can't crack later.

Shamir sharing & GF(2⁸)?

Shamir Secret Sharing splits a secret into n pieces so any t of them rebuild it and fewer reveal nothing. It works by fitting a random polynomial through the secret over GF(2⁸) — the finite field of one byte (values 0–255 with wrap-around arithmetic). Analogy: 2 points fix a straight line, so any 2 shares fix the same line and recover the secret; 1 point leaves infinitely many lines.

What does “lattice-based” mean?

Lattice-based crypto builds its security on the hardness of finding short vectors in a high-dimensional grid of points (a lattice) — a problem no known quantum algorithm solves efficiently. Analogy: finding the nearest lamppost in a vast, tilted 3-D city grid is easy in 2-D but brutal in hundreds of dimensions. That hardness is what makes SMAUG-T and HAETAE post-quantum.

Signature vs. verify?

Signing uses a private key to stamp data with proof it wasn't altered; verifying uses the matching public key to check that stamp. Analogy: a wax seal on an envelope — only the owner's ring makes it (sign), but anyone can confirm it's unbroken (verify). Here HAETAE signs the sealed box; on open we verify first, so a tampered container is rejected before any password is tried.

Why quantum-safe? Step 3 uses SMAUG-T instead of classical RSA/ECDH. Toggle to see why:

SMAUG-T's security rests on the Module-LWE lattice problem, for which no efficient quantum algorithm is known. The same harvested box stays sealed even against a future quantum attacker — that is exactly what the post-quantum KEM buys you here.

AES-256-GCM Shamir SSS / GF(2⁸) SMAUG-T (스마우그-T) — KEM HAETAE (해태) — signature

Research Origin

This project demonstrates Korean post-quantum cryptographic algorithms compiled to WebAssembly for educational and experimental use.

Algorithms included:

The implementations are derived from reference code produced by Korean cryptography researchers as part of the KpqC competition.

Go deeper — when to use each primitive (and what breaks if you don’t)

⚡ Quick Decision Rules

Encrypt data at rest → AES-256-GCM Not AES-CBC, not ECB
Split a key among parties → Shamir SSS / GF(2⁸) Not XOR splitting
Quantum-safe key exchange → SMAUG-T KEM / ML-KEM Not raw RSA, not static DH
Sign & verify data → HAETAE / ML-DSA Not RSA-PKCS1v1.5

When unsure → AES-256-GCM + Argon2id + ML-KEM. These are safe defaults.

💥 What Breaks If You Choose Wrong

Nonce reuse (AES-GCM)

Attacker recovers XOR of plaintexts + the authentication key. Total break.

Too few Shamir shares

Reconstruction produces random garbage. No partial leak — information-theoretically secure.

Skip signature verification

Attacker substitutes containers or shares. Chosen-ciphertext attacks become possible.

Classical-only key exchange

Harvest now, decrypt later. Quantum computer breaks RSA/ECDH retroactively.

⚠️ Disclaimers