ArchitectureArchitecture

Cryptographic stack

Every primitive is a NIST standard or an established RFC, sourced from the open-source noble suite and the browser-native WebCrypto API. The classical curves and hashes have been independently audited (Argon2id aside); the post-quantum library has not been independently audited yet.

Hybrid key encapsulation

Each file is sealed to two key encapsulation mechanisms at once. The shared secrets from ML-KEM-768 (post-quantum) and X25519 (classical) are combined through HKDF-SHA256 into the symmetric key. An attacker must break both to recover the key: the same defense-in-depth approach used by Signal, Chrome, and Cloudflare.

ML-KEM-768 shared secret  ┐
                          ├─► HKDF-SHA256(domain-separated) ─► AES-256-GCM key
X25519 shared secret      ┘

The .kvant container

The cleartext header carries only what is needed to begin decryption: the format, the algorithm, the key encapsulations, the nonce and the encrypted length. The filename, the exact size and the file bytes live inside the authenticated payload, so a .kvant file never shows its name or its contents in the clear. Its encrypted length does track the file size.

After the payload comes an ML-DSA-65 signature over the header and the ciphertext, bound to the context string pqenv-v1-file. A /m message is a .kvant container too, so it is signed under the same context. Signed x402 payloads use pqenv-v1-x402, so a signature produced for an envelope can never be replayed as a receipt, or the other way round.

Wallet-derived identity

Your keypair can come from a passphrase-protected key file or from your wallet. The wallet path signs one fixed message; that signature is fed through HKDF to derive the hybrid keypair. A wallet that signs the same message the same way every time produces the same keys, in the browser and over the MCP server: so a file you encrypt to your wallet in /app opens in your agent with no key export.

• EOA only. Reproducible keys need a reproducible signature. Externally-owned accounts with a local private key (MetaMask, Rabby, Phantom) sign with RFC 6979 and give the same bytes every time. Smart-contract wallets are rejected at derivation by a shape check and an address-recovery check.
• Checked on first use. MPC and threshold signers produce valid signatures that recover to the address and still differ on every request. So the first time an address derives keys on a device, the app asks for two signatures and refuses if they differ. Only the outcome is remembered in the browser, never a signature.
• The signature is the key. The message says it grants no permissions. It approves no transaction, yet anyone who holds the signature can rebuild the keypair and open every file sealed to it. Sign the Kvant message only on kvant.world or in your own agent. Its wording cannot change in v1 without changing every key.
• Keep a backup. Losing the wallet means losing the keys. After your first derivation, save a passphrase-wrapped key file from /app (Back up keys): it holds the same keypair and opens your files without the wallet.

Built to outlive its own format

Every artifact records its version and algorithm identifier. Unknown versions are rejected with a clear error, and new standardized suites can be added without breaking the files you create today.