GoKawiilApple today published new corecrypto source code on GitHub, alongside a detailed technical post explaining the intricate work behind its post-quantum cryptography efforts across iPhone, Mac, and more. Here are the details.
Apple continues its post-quantum security work
Earlier today, Apple published a new corecrypto repository on GitHub as part of a broader update to its post-quantum cryptography work, which started rolling out publicly in 2024 with iMessage’s PQ3 protocol.
Announced with iOS 17.4, PQ3 was Apple’s first major public step toward protecting users against future quantum computers, with iMessage adding post-quantum protection both when a conversation starts and as encryption keys are refreshed over time.
Today’s announcement continues that work, with the GitHub repository including source code for corecrypto, the low-level cryptographic library used by Apple’s Security framework, CryptoKit, and CommonCrypto to power encryption, hashing, random number generation, and digital signatures.
The repository also includes Apple’s implementations of ML-KEM and ML-DSA (the two post-quantum algorithms the company chose for corecrypto), as well as tests, performance tools, build targets, and a dedicated formal verification folder.
According to Apple, the latter contains the proof work and supporting tools used to check that its implementations match FIPS 203 and FIPS 204, the NIST standards for ML-KEM (used to help establish secure encryption keys) and ML-DSA (used for digital signatures), designed to protect against known threats posed by future quantum computers.
Apple details its post-quantum security work
Alongside the repository, Apple also published a very detailed look at how it verified this code before making it available for outside review, and why it is releasing today’s material.
With the latest release of corecrypto source code on May 22, 2026, we’re sharing meaningful advances in applied formal verification with the global cryptographic community, including the details of our approach and the tools we used. They are released openly to encourage wider adoption, support critical review of our work, and help advance the state of the art for assuring critical software.
... continue reading