Nexus-Q: un motor open source de Rust para PQC

Nexus-Q is an open-source Rust security engine that provides post-quantum protection for data, keys and identities by combining standardized lattice algorithms (ML-KEM and ML-DSA) with classical X25519 in hybrid exchanges. It is library-first: a Rust core implements vaults (Argon2id-unlocked, atomic writes), key lifecycle (generation, rotation, revocation, zeroization), authenticated envelope encryption (AES-256-GCM or ChaCha20-Poly1305), signatures (Ed25519, ML-DSA-65, SLH-DSA-SHAKE-128f) and a tamper-evident HMAC-authenticated audit log with rollback anchoring. Policy enforcement is deny-by-default, hardware abstraction exists for TPM/HSM/SE/RISC-V providers, and five Rust crates are exposed via SDKs (C, Python, Go, PHP, Ruby) plus a reproducible PQC Benchmark Arena with retained CI artifacts.

The repository documents a strict cryptographic whitelist (six primitive families), a published threat model and security CI including fuzzing, but it explicitly does not claim independent audits, certifications, formal verification or production readiness. Versions V1-V3 are engineering baselines with V3 focused on hardening and reproducible evidence; V4 plans architecture-specific AVX2/NEON kernels behind feature dispatch after differential testing and constant-time review. Performance is reported honestly (not a leader), and contribution paths invite running the Arena, reviewing models, testing platforms and joining optimization work.