How pSIONIUM works

Encrypting a file

Six steps, each built from a standardized primitive. The default suite is shown; the CNSA suite replaces the hybrid exchange with ML-KEM-1024 and signs with ML-DSA-87.

1. 1

   A fresh key for every file

   psion draws a random 256-bit file key and a random salt. Nothing is reused between files.

2. 2

   Post-quantum key exchange per recipient

   For each recipient, an ephemeral X25519 exchange and an ML-KEM-768 encapsulation produce two shared secrets. HKDF-SHA-384 combines them with the whole exchange transcript into a key-encryption key, so the file stays safe while either algorithm holds.

3. 3

   The file key is wrapped

   AES-256-GCM wraps the file key under each key-encryption key, bound to the header. Only listed recipients can unwrap it.

4. 4

   The header is sealed

   An HMAC-SHA-384 over the header, keyed from the file key, protects the suite, chunk size, flags, salt and every recipient entry.

5. 5

   Data is encrypted in chunks

   The payload is split into 64 KiB chunks, each sealed with AES-256-GCM under a nonce that carries the chunk number and a final-chunk flag. Reordering, dropping or appending chunks is detected, and files of any size stream in a few MB of memory.

6. 6

   Optionally, the sender signs

   With --sign-with, an ML-DSA signature covers a SHA-384 hash of the complete header and payload, so recipients can prove who produced exactly this file.

Keys you can read

Every key is one line of text with a prefix that says what it is, so a public key can never be mistaken for a secret one.

What it protects, and what it doesn’t

A summary of the threat model.

How pSIONIUM Scan sorts what it finds

Every finding names the file and line, or the server, so you can judge it. Export a CycloneDX 1.6 cryptography bill of materials for your inventory, or fail a CI build when quantum-vulnerable code appears.