The Z6 PQC Gateway implements key encapsulation using ℤ₆ cyclic topology — no lattice noise, no NTT, no isogenies. Zero-trust, memory-scrubbing, hardware-agnostic.
The Z6 PQC Gateway replaces continuous lattice-based KEMs with discrete ℤ₆ arithmetic. Each element is a phase in {0,1,2,3,4,5} — no floating point, no noise sampling, no NTT polynomial multiplication.
All operations are mod-6: add, subtract, multiply in ℤ₆. Deterministic, constant-time, trivially side-channel resistant. No continuous parameters to leak.
Phase states are projected onto the nearest Z6 lattice point. Noise within ±π/6 is absorbed; noise at the π/6 boundary triggers an enforced collapse — detectable, non-forgeable.
All ephemeral key material is zeroed immediately after use. Private keys, shared secrets, and intermediate buffers are overwritten in a finally block — guaranteed cleanup.
Run a complete key encapsulation cycle in your browser. Client and server generate ℤ₆ key pairs, negotiate a shared secret, and the topological shield validates every step.
The Z6 topological shield enforces phase quantization at every gateway hop. No active error correction — just geometry.
Every Z6 element is projected to the nearest multiple of π/3. Deviation beyond ±π/6 triggers a detectable topological collapse.
At the exact midpoint between two Z6 states (deviation = π/6), the shield rejects the operation with a 403 — no ambiguity, no false acceptance.
Shield projection uses integer rounding — no branches on secret data. The validation cost is identical for all 6 phase states.
The shield adds no per-request latency, no memory allocation, and no additional network round-trips. It runs inline in the Worker's fetch handler.
This is a live security research interface. Submit crafted public keys to the gateway and see which defenses trigger. All attacks are logged as anonymous metrics — no key data is stored. Can you find a key that passes every check?
Quick-craft attack vectors to probe the shield:
Paste a base64url-encoded public key (24 bytes) or leave empty to generate random:
Only attack type, danger score, and which checks triggered are stored locally. No key data is ever saved.
Every component is self-contained. No external dependencies, no hardware assumptions, no trusted setup.
Mod-6 arithmetic (add, sub, mul) and continuous-to-discrete phase mapping. Every real angle is snapped to the nearest π/3 step with a bounded deviation.
Each Z6 element fits in 3 bits (values 0-5). 64 elements pack into 24 bytes. Serialization is a single O(n) bit-shift loop — no alloc, no compression.
Client generates 64 random Z6 elements as its keypair. Server generates its own. Shared secret is element-wise ℤ₆ multiplication — commutative by construction.
In the finally block of every request, all Uint8Array and number[] buffers are filled with zero. No ephemeral key material survives past the response.
Every property of the Z6 PQC gateway is verified — arithmetic, packing, topological shield, key agreement, and memory safety.
Make a real request to the Z6 PQC Gateway, verify the topological shield header, and perform a live KEM handshake.
Use the KEM shared secret to derive an AES-256-GCM key and encrypt/decrypt messages. Your Z6 public key serves as the identity.
Generate shared secrets for multiple public keys in a single request (one per line):
Deploy the gateway worker to your own Cloudflare account. No external dependencies, no third-party APIs.