Recently I attended a conference talking about secure implementation's regarding PQC Encryption, due to the latest trends and also the threat of "harvest now, decrypt later" I decided to try and rewrite an implementation of the iron-session lib which uses post quantum encryption under the hood, and falls back to iron-seal if not, this prevents any "harvest now, decrypt later" risk for when quantum computers become more available. Under the hood the session uses ML-KEM512 (formerly known as Kyber-512), a NIST-approved post-quantum key encapsulation mechanism, which provides 128-bit security that's resistant to attacks from quantum computers.

Users can also opt-in with a single flag (usePostQuantum: true) with no breaking changes, this allows people to use the lib as per usual without any breaking changes unless they want to enable it.

This is very much a work in progress, this is the first working build I have which passes every test:

ℹ tests 25
ℹ suites 0
ℹ pass 25
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 159.677417

Post-quantum cookie size: 2984 bytes
Detected ML-KEM version: 512
Public key length: 800, Ciphertext length: 768
✔ should encrypt and decrypt data with post-quantum encryption (7.63525ms)

I have tried to update the README as much as possible, and also added a "When to use it" section. Any feedback or advice would be brilliant.