Rationale
This PR introduces contrib/pq-shield, a standalone toolset implementing CRYSTALS-Dilithium Mode3 signature scheme. This serves as a foundational step for PIP-2030, addressing the quantum vulnerability of ECDSA by 2030.
Technical Approach
- Algorithm: Dilithium Mode3 (NIST PQC finalist).
- Implementation: Go-based wrapper around Cloudflare’s Circl library.
- Components:
pq-shield: CLI for key generation, signing, and verification.audit: Forensic tool for validating key formats and permissions.
- Security: Includes fuzz testing and strict file permission checks (0600 for private keys).
Tests
- Unit tests cover key generation, signing round-trip, and tamper resistance.
- Fuzz testing implemented for signature verification.
- Verified locally on Linux/Windows.
Impact
No changes to consensus code. This is a purely additive tool in contrib/ for experimentation and future integration planning.