Skip to main content

pq-oid

OID constants and utilities for NIST post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA). Zero dependencies. Works in Node, Bun, Deno, and browsers.

Audit status: This package has not yet been independently audited. A security audit is pending — see Security policy.

Installation​

npm install pq-oid
# or
bun add pq-oid
# Cargo.toml
[dependencies]
pq-oid = "1.0"

Layering​

pq-oid is the low-level OID primitive: it exposes constants, OID encode/decode, and an Algorithm metadata table. For canonical multi-identifier mapping (name / oid / jose / cose / x509), use pq-algorithm-id. The JOSE/COSE helpers in pq-oid are retained for backward compatibility but are deprecated in favor of pq-algorithm-id.

Usage​

OID constants​

import { OID, Algorithm } from 'pq-oid';

OID.ML_KEM_512    // '2.16.840.1.101.3.4.4.1'
OID.ML_KEM_768    // '2.16.840.1.101.3.4.4.2'
OID.ML_KEM_1024   // '2.16.840.1.101.3.4.4.3'
OID.ML_DSA_44     // '2.16.840.1.101.3.4.3.17'
OID.ML_DSA_65     // '2.16.840.1.101.3.4.3.18'
OID.ML_DSA_87     // '2.16.840.1.101.3.4.3.19'
// ... and 12 SLH-DSA variants

Name and OID conversion​

OID.fromName('ML-DSA-65');             // '2.16.840.1.101.3.4.3.18'
OID.toName('2.16.840.1.101.3.4.3.18'); // 'ML-DSA-65'

DER encoding for ASN.1​

OID.toBytes('2.16.840.1.101.3.4.4.1'); // Uint8Array
OID.fromBytes(bytes);                   // '2.16.840.1.101.3.4.4.1'

JOSE/COSE mappings (compatibility — prefer pq-algorithm-id in new code)​

OID.toJOSE('ML-DSA-65');   // 'ML-DSA-65'
OID.toCOSE('ML-DSA-65');   // -49
OID.fromJOSE('ML-DSA-65'); // 'ML-DSA-65'
OID.fromCOSE(-49);         // 'ML-DSA-65'

Algorithm metadata​

Algorithm.get('ML-DSA-65');
// {
//   name: 'ML-DSA-65',
//   oid: '2.16.840.1.101.3.4.3.18',
//   type: 'sign',
//   family: 'ML-DSA',
//   securityLevel: 3,
//   publicKeySize: 1952,
//   privateKeySize: 4032,
//   signatureSize: 3309
// }

Algorithm.list();                  // all 18 algorithm names
Algorithm.listByType('kem');       // ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']
Algorithm.listByType('sign');      // ML-DSA + SLH-DSA variants
Algorithm.listByFamily('ML-DSA');  // ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']

Rust​

use pq_oid::{MlDsa, Algorithm};

let dsa: MlDsa = "ML-DSA-65".parse().unwrap();
assert_eq!(dsa.oid(), "2.16.840.1.101.3.4.3.18");

let alg = Algorithm::from_name("ML-DSA-65").unwrap();
assert_eq!(alg.public_key_size(), 1952);
assert_eq!(alg.signature_size(), 3309);

The Rust crate is no_std capable.