Apple has released new corecrypto source code on GitHub, detailing its formal verification process for post-quantum cryptographic algorithms designed to protect user data against future quantum computing threats.

Key Points

• Apple published source code for ML-KEM and ML-DSA algorithms, which align with NIST standards FIPS 203 and FIPS 204.
• The repository includes custom tools like a Cryptol-to-Isabelle translator used to verify that implementations match official cryptographic standards.
• Formal verification helped Apple identify and resolve critical errors, including a potential data corruption issue in an early ML-DSA implementation.
• The code supports both portable C and hand-optimized ARM64 assembly to ensure compatibility across the entire Apple silicon product lineup.
• This release follows the 2024 introduction of the PQ3 protocol for iMessage, marking a continued expansion of Apple's post-quantum security infrastructure.

Why it Matters

This initiative represents a significant shift toward transparency in high-stakes cybersecurity, allowing independent researchers to audit the foundational code protecting Apple devices. By sharing these formal verification methods, Apple aims to set a higher standard for software assurance while proactively defending against the long-term risks posed by quantum computing.