Original title: Auditable Conformance and Cross-Library Interoperability Testing for ML-KEM and ML-DSA
Sijiang Xie, Xingyu Lu, Haida Wang, Hong Zhao · September 2026
Programs that scramble or sign secret digital data might work fine alone, but they can still fail when sharing files with other software. To solve this, researchers built a trackable testing process to check two security tools, liboqsAn open-source library that provides implementations of post-quantum cryptographic algorithms. and PQMagicAnother library that implements post-quantum cryptographic algorithms, used for comparison in this work.. These tools use two standards named ML-KEMA post-quantum encryption algorithm for exchanging secret keys securely, even against quantum computers. and ML-DSAA post-quantum digital signature algorithm for verifying who signed a message, resistant to quantum attacks.. The system feeds fixed test data into both programs. It checks if they produce matching outputs and whether each program can read files made by the other. It also alters single bits of data on purpose to ensure both tools reject bad inputs. Everything ties back to exact digital fingerprints. The test succeeded completely. Both programs matched all 690 expected test outcomes and passed all 1200 sharing trials. They also correctly caught all 90 corrupted files.
Imagine two chefs each follow the same recipe for chocolate cake. Both cakes look fine in their own kitchens. But when you try to serve one chef's cake on the other chef's plate, it does not fit — the sizes are slightly off. In this paper, the recipe is the ML-KEM and ML-DSA standards, the chefs are the liboqs and PQMagic libraries, and the plates are the raw data artifacts each library produces. The test workflow checks whether every cake from one chef fits perfectly on the other chef's plate.
If two implementations of the same encryption standard cannot exchange data, systems that rely on them break silently. This work shows how to catch those mismatches before deployment, which matters for anyone building secure communications with post-quantum cryptography — banks, messaging apps, government systems — where a single incompatible artifact can stop a handshake or corrupt a signature.
The work does not establish product certification, protocol interoperability, or stable performance rankings across sessions. Cross-version compatibility is not tested — the regression check only covers two builds from the same commit. Performance measurements are a single-session snapshot on one Windows host. The deployment considerations are a taxonomy and checklist, not a validated decision procedure. Aigis and SHAKE/SM3 comparisons are supporting analyses, not extensions of the standardized cross-library compatibility claim.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Auditable Conformance and Cross-Library Interoperability Testing for ML-KEM and ML-DSA — Sijiang Xie, Xingyu Lu, Haida Wang et al. — Computers — doi:10.3390/computers15100642
Abstract licence: CC BY
Explanation generated by Synthesis from the abstract — it is not the original paper.