Developers
MyPQC developer
documentation.
Build quantum-safe and crypto-agile applications with the Antrapol JCE provider. It is a drop-in
Java Cryptography Extension. Your
Signature
and
KeyPairGenerator
and
Cipher
calls stay exactly as they are. Policy decides which algorithm runs and how the bytes are packaged.
Java 17 · ML-KEM · ML-DSA · SLH-DSA · KAZ-SIGN · classical RSA / ECDSA / AES
Start here
Everything you need to integrate
Install the provider. Sign your first payload. See how policy swaps algorithms without touching caller code.
Antrapol JCE SDK: Getting started
Prerequisites · Antrapol.install() · your first quantum-safe signature end to end.
Learn moreAlgorithm support
Every supported service. Signatures · KEM · digests · symmetric ciphers · key generators · variant naming.
Learn moreCrypto-agility concepts
The ciphagile envelope · RAW vs AGILITY output modes · wrapped keys · how callers stay decoupled from algorithms.
Learn morePolicy-driven resolution
Bind a business purpose to a thread and let a policy resolver pick the effective algorithm and key variant and signing digest.
Learn moreProduct guides
Using the platform screen by screen
Step-by-step guides for running a MyPQC product day to day. For the people who operate it and not just the people who integrate it.
Overview
What is the Antrapol JCE provider?
Antrapol is a policy-driven crypto-agility JCE provider wrapper. It registers a standard
Java Security
Provider
named
"Antrapol"
and keeps normal JCE caller semantics while doing three things underneath.
Delegates the real crypto
Actual cryptographic execution is delegated to underlying providers (BouncyCastle · the KAZ provider · SunRsaSign · SunEC · SunJCE). These load dynamically from configured JAR paths.
Packages outputs into an agility envelope
The default AGILITY output mode wraps bytes with algorithm and variant metadata. That means they can be decoded and verified later even after your organization changes its default algorithm.
Resolves algorithms from policy
A business purpose and operation can be bound to a thread. A policy resolver then decides the effective algorithm and key size or curve and signing digest.
Caller-facing code stays familiar. Which algorithm runs and how the bytes are represented become policy-driven instead. That gives you a migration path to post-quantum (ML-DSA · SLH-DSA · ML-KEM and Malaysia's KAZ-SIGN) without rewriting application code.
import java.security.*;
import java.nio.charset.StandardCharsets;
import com.antrapol.jce.Antrapol;
// 1. Register the "Antrapol" provider at position 1
Antrapol.install();
// 2. Generate a post-quantum ML-DSA-65 key pair (FIPS 204)
KeyPairGenerator kpg =
KeyPairGenerator.getInstance("ML-DSA", "Antrapol");
kpg.initialize(65);
KeyPair kp = kpg.generateKeyPair();
// 3. Sign with the standard JCE Signature API
Signature signer = Signature.getInstance("ML-DSA-65", "Antrapol");
signer.initSign(kp.getPrivate());
signer.update("payload".getBytes(StandardCharsets.US_ASCII));
byte[] sig = signer.sign(); // AGILITY envelope by default
// 4. Verify with the auto signer. Algorithm read from the envelope
Signature verifier = Signature.getInstance("Antrapol", "Antrapol");
verifier.initVerify(kp.getPublic());
verifier.update("payload".getBytes(StandardCharsets.US_ASCII));
boolean ok = verifier.verify(sig);
The same code works for KAZ-SIGN-128/192/256 and SLH-DSA-128/192/256. Change the algorithm name and nothing else.
Crypto-agility
Change the algorithm by policy instead of by pull request
KAZ-SIGN and KAZ-KEM are optional policy-selectable Malaysian algorithms offered alongside the NIST PQC standards. The choice is decoupled from caller code. You can swap the effective algorithm centrally at any time.
NIST-aligned PQC
Implements the ML-KEM (FIPS 203) · ML-DSA (FIPS 204) · SLH-DSA (FIPS 205) algorithms via the delegate providers.
National options
KAZ-SIGN is offered as an optional policy-selectable Malaysian algorithm alongside the NIST standards. It is never a replacement for them.
Compliance hygiene
Weak digests (MD5 · SHA-1 · SHA-224) are upgraded automatically. RSA keys of 1024 bits or less are rejected.
Ready to build quantum-safe?
Get platform access and delegate provider JARs and a policy-service endpoint for your team.