[W.I.P] adding ML-KEM512 to the iron-session seal and unseal functions.

.gitignore

@@ -6,3 +6,5 @@ dist
 coverage*
 *.tsbuildinfo
 .turbo
+
+package-lock.json

README.md

@@ -26,6 +26,8 @@
 The session data is stored in signed and encrypted cookies which are decoded by your server code in a stateless fashion (= no network involved). This is the same technique used by frameworks like
 [Ruby On Rails](https://guides.rubyonrails.org/security.html#session-storage).
 
+**New in v8.1**: Post-quantum cryptography support to protect against future quantum computing attacks.
+
 <p align="center"><i>Online demo and examples: <a href="https://get-iron-session.vercel.app/">https://get-iron-session.vercel.app</a></i> 👀 <br/>
  <i>Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></i> ⭐️</p>
 
@@ -37,6 +39,7 @@ The session data is stored in signed and encrypted cookies which are decoded by
 - [Examples](#examples)
 - [Project status](#project-status)
 - [Session options](#session-options)
+- [Post-Quantum Cryptography](#post-quantum-cryptography)
 - [API](#api)
   - [`getIronSession<T>(req, res, sessionOptions): Promise<IronSession<T>>`](#getironsessiontreq-res-sessionoptions-promiseironsessiont)
   - [`getIronSession<T>(cookieStore, sessionOptions): Promise<IronSession<T>>`](#getironsessiontcookiestore-sessionoptions-promiseironsessiont)
@@ -130,6 +133,7 @@ Two options are required: `password` and `cookieName`. Everything else is automa
 - `password`, **required**: Private key used to encrypt the cookie. It has to be at least 32 characters long. Use <https://1password.com/password-generator/> to generate strong passwords. `password` can be either a `string` or an `object` with incrementing keys like this: `{2: "...", 1: "..."}` to allow for password rotation.  iron-session will use the highest numbered key for new cookies.
 - `cookieName`, **required**: Name of the cookie to be stored
 - `ttl`, _optional_: In seconds. Default to the equivalent of 14 days. You can set this to `0` and iron-session will compute the maximum allowed value by cookies.
+- `usePostQuantum`, _optional_: Boolean flag to enable post-quantum encryption. Default is `false`. When enabled, uses ML-KEM1024 for key exchange instead of the traditional encryption. See [Post-Quantum Cryptography](#post-quantum-cryptography) for more details.
 - `cookieOptions`, _optional_: Any option available from [jshttp/cookie#serialize](https://github.com/jshttp/cookie#cookieserializename-value-options) except for `encode` which is not a Set-Cookie Attribute. See [Mozilla Set-Cookie Attributes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes) and [Chrome Cookie Fields](https://developer.chrome.com/docs/devtools/application/cookies/#fields). Default to:
 
   ```js
@@ -142,6 +146,37 @@ Two options are required: `password` and `cookieName`. Everything else is automa
   }
   ```
 
+## Post-Quantum Cryptography
+
+Iron-session now supports post-quantum cryptography to protect your session data against future quantum computing attacks. This feature is opt-in and can be enabled by setting `usePostQuantum: true` in your session options.
+
+```ts
+// Enable post-quantum encryption
+const session = await getIronSession(req, res, {
+  password: "your-password-at-least-32-characters-long",
+  cookieName: "your-cookie-name",
+  usePostQuantum: true
+});
+```
+
+### How it works
+
+When post-quantum encryption is enabled:
+
+1. The session uses ML-KEM1024 (formerly known as Kyber-1024), a NIST-approved post-quantum key encapsulation mechanism
+2. This provides 256-bit security that's resistant to attacks from quantum computers
+3. The implementation maintains AES-GCM for symmetric encryption after secure key exchange
+
+### When to use it
+
+Post-quantum cryptography is recommended if:
+
+- You need long-term security for sensitive session data
+- You want to future-proof your application against quantum computing advances
+- You're handling particularly sensitive information that requires the highest level of cryptographic protection
+
+The feature has a minimal performance impact and provides a significant security improvement for forward-looking applications.
+
 ## API
 
 ### `getIronSession<T>(req, res, sessionOptions): Promise<IronSession<T>>`

package.json

@@ -1,79 +1,83 @@
 {
-  "name": "iron-session",
-  "version": "8.0.4",
-  "description": "Secure, stateless, and cookie-based session library for JavaScript",
-  "keywords": [
-    "session",
-    "secure",
-    "stateless",
-    "cookie",
-    "encryption",
-    "security",
-    "next.js",
-    "node.js"
-  ],
-  "bugs": "https://github.com/vvo/iron-session/issues",
-  "repository": "github:vvo/iron-session",
-  "funding": [
-    "https://github.com/sponsors/vvo",
-    "https://github.com/sponsors/brc-dd"
-  ],
-  "license": "MIT",
-  "author": "Vincent Voyer <vincent@codeagain.com> (https://github.com/vvo)",
-  "sideEffects": false,
-  "type": "module",
-  "exports": {
-    "import": "./dist/index.js",
-    "require": "./dist/index.cjs"
-  },
-  "main": "./dist/index.cjs",
-  "files": [
-    "dist/*"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "pnpm build && concurrently \"pnpm build --watch\" \"pnpm --filter=next-example dev\" ",
-    "lint": "tsc --noEmit && tsc --noEmit -p examples/next/tsconfig.json && pnpm eslint . && publint",
-    "prepare": "pnpm build && tsc --noEmit",
-    "start": "turbo start --filter=next-example",
-    "test": "c8 -r text -r lcov node --import tsx --test src/*.test.ts && pnpm build",
-    "test:watch": "node --import tsx --test --watch src/*.test.ts"
-  },
-  "prettier": {
-    "plugins": [
-      "prettier-plugin-packagejson"
-    ],
-    "trailingComma": "all"
-  },
-  "dependencies": {
-    "cookie": "^0.7.2",
-    "iron-webcrypto": "^1.2.1",
-    "uncrypto": "^0.1.3"
-  },
-  "devDependencies": {
-    "@types/cookie": "0.6.0",
-    "@types/node": "20.17.24",
-    "@typescript-eslint/eslint-plugin": "7.18.0",
-    "@typescript-eslint/parser": "7.18.0",
-    "c8": "10.1.3",
-    "concurrently": "8.2.2",
-    "eslint": "8.57.1",
-    "eslint-config-prettier": "9.1.0",
-    "eslint-import-resolver-node": "0.3.9",
-    "eslint-import-resolver-typescript": "3.9.1",
-    "eslint-plugin-import": "2.31.0",
-    "eslint-plugin-prettier": "5.2.5",
-    "prettier": "3.5.3",
-    "prettier-plugin-packagejson": "2.5.10",
-    "publint": "0.3.9",
-    "tsup": "8.4.0",
-    "tsx": "4.19.3",
-    "turbo": "^2.0.5",
-    "typescript": "5.8.2"
-  },
-  "packageManager": "pnpm@9.6.0",
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org"
-  }
+	"name": "iron-session",
+	"version": "8.0.4",
+	"description": "Secure, stateless, and cookie-based session library for JavaScript",
+	"keywords": [
+		"session",
+		"secure",
+		"stateless",
+		"cookie",
+		"encryption",
+		"security",
+		"next.js",
+		"node.js"
+	],
+	"bugs": "https://github.com/vvo/iron-session/issues",
+	"repository": "github:vvo/iron-session",
+	"funding": [
+		"https://github.com/sponsors/vvo",
+		"https://github.com/sponsors/brc-dd"
+	],
+	"license": "MIT",
+	"author": "Vincent Voyer <vincent@codeagain.com> (https://github.com/vvo)",
+	"sideEffects": false,
+	"type": "module",
+	"exports": {
+		"import": "./dist/index.js",
+		"require": "./dist/index.cjs"
+	},
+	"main": "./dist/index.cjs",
+	"files": [
+		"dist/*"
+	],
+	"scripts": {
+		"build": "tsup",
+		"dev": "pnpm build && concurrently \"pnpm build --watch\" \"pnpm --filter=next-example dev\" ",
+		"lint": "tsc --noEmit && tsc --noEmit -p examples/next/tsconfig.json && pnpm eslint . && publint",
+		"prepare": "pnpm build && tsc --noEmit",
+		"start": "turbo start --filter=next-example",
+		"test": "c8 -r text -r lcov node --import tsx --test src/*.test.ts && pnpm build",
+		"test:watch": "node --import tsx --test --watch src/*.test.ts"
+	},
+	"prettier": {
+		"plugins": [
+			"prettier-plugin-packagejson"
+		],
+		"trailingComma": "all"
+	},
+	"dependencies": {
+		"@noble/hashes": "^1.7.1",
+		"@noble/post-quantum": "^0.4.0",
+		"cookie": "^0.7.2",
+		"http": "^0.0.1-security",
+		"iron-webcrypto": "^1.2.1",
+		"rfc4648": "^1.5.4",
+		"uncrypto": "^0.1.3"
+	},
+	"devDependencies": {
+		"@types/cookie": "0.6.0",
+		"@types/node": "20.17.24",
+		"@typescript-eslint/eslint-plugin": "7.18.0",
+		"@typescript-eslint/parser": "7.18.0",
+		"c8": "10.1.3",
+		"concurrently": "8.2.2",
+		"eslint": "8.57.1",
+		"eslint-config-prettier": "9.1.0",
+		"eslint-import-resolver-node": "0.3.9",
+		"eslint-import-resolver-typescript": "3.9.1",
+		"eslint-plugin-import": "2.31.0",
+		"eslint-plugin-prettier": "5.2.5",
+		"prettier": "3.5.3",
+		"prettier-plugin-packagejson": "2.5.10",
+		"publint": "0.3.9",
+		"tsup": "8.4.0",
+		"tsx": "4.19.3",
+		"turbo": "^2.5.0",
+		"typescript": "5.8.3"
+	},
+	"packageManager": "pnpm@9.6.0",
+	"publishConfig": {
+		"access": "public",
+		"registry": "https://registry.npmjs.org"
+	}
 }