filippo.io/mlkem768 — Post-Quantum Cryptography for the Go Ecosystem. It was shared on Show HN in 2024 and received 315 upvotes on Hacker News. filippo.io/mlkem768 is a pure-Go implementation of the post-quantum key exchange mechanism ML-KEM-768 optimized for correctness and readability. ML-KEM (formerly known as Kyber, renamed because we can’t have nice things) is a post-quantum key exchange mechanism in the process of being standardized by NIST and adopted by most of the industry. It’s meant for upstreaming into the Go standard library (initially as an internal-only package used in an opt-in crypto/tls experiment) and was designed to provide high security assurance through ease of review, simplicity, and thorough testing. Unlike most other implementations, this code was not ported from the reference pq-crystals library, but written from scratch not having ever closely read other codebases. This was an intentional exercise in spec validation, to show it is possible to produce an interoperable implementation from the specification alone. Modulo arithmetic was reasonably easy, as we all collectively learned a lot about finite field arithmetic through years of RSA and elliptic curve implementations. The small prime actually makes the task feel unnaturally simple. In my public comments I pointed out that having each implementation figure out a strategy is risky and redundant. This package was unaffected, because it used Barrett reduction from the start, like BoringSSL. Reading the Go cryptography standard library is how I got started on the path that led me here, so it is especially important to me to preserve and improve it as a learning resource. A universal 1-to-12 bit encoder and decoder is a pretty gnarly piece of code to write correctly, but each of those four sizes are actually pretty easy to write a dedicated encoder/decoder for. 1 This is why we have ringCompressAndEncode1/4/10 etc. This, by the way, was only possible because we targeted ML-KEM-768 specifically, or we’d have had to implement 5- and 11-bit encodings, as well.