Overview
QAVACH is a production-grade reference architecture for migrating national e-Governance services to Post-Quantum Cryptography (PQC). It demonstrates a crypto-agile signing and certificate pipeline that can survive the arrival of cryptographically-relevant quantum computers — without rewriting every downstream government service.
🥇 1st Prize — CyberShield 2026, organised by MeitY, ISEA, and CISCO.
The Problem
Most e-Governance signing today relies on RSA / ECDSA. Once a sufficiently large quantum computer exists, “harvest-now, decrypt-later” attacks make every archived signature and document forgeable. Governments need a migration path that is backwards-compatible and incremental.
Architecture
- Mock CA — a standalone Certificate Authority that issues hybrid (classical + PQC) X.509 certificates, modelling a real national CA.
- GovSign API — a FastAPI backend that exposes signing, verification, and certificate-issuance endpoints to consuming services.
- Crypto-agility layer — algorithms (Dilithium, Falcon, SPHINCS+) are pluggable behind a single interface, so the signature scheme can be rotated without touching business logic.
Tech Stack
- Python · FastAPI
liboqs/ Open Quantum Safe for PQC primitives- Hybrid X.509 certificate chains
- Containerised, horizontally scalable services
Highlights
- End-to-end hybrid signing demo across multiple mock government departments.
- Drop-in verification middleware for existing services.
- Designed for a phased, zero-downtime national rollout.