# Post-quantum crypto, workload identity, and the Go 1.25 gap closed

> On main since rc2: Post-quantum crypto, workload identity, and the Go 1.25 gap closed.

Source: https://kern-lang.eu/releases/post-quantum-crypto-workload-identity

On main since rc2

## Release notes

The standard library grew from 303 modules to **354**, and from 2,219 public functions to **2,982**, in three deliberate directions.

### Forward-looking crypto and identity

ML-KEM-768 and ML-KEM-1024 (FIPS 203, up to Security Level 5) for post-quantum key encapsulation, mTLS with SPIFFE workload identity, a CBOR codec, OpenTelemetry across all three signals, and SLSA build provenance. The SPIFFE claim is stated precisely: `svid_verify` checks X.509-SVID fields (expiry, issuer, format), and signature and chain verification stay with the caller against the trust bundle. A WebAuthn module landed in the same wave and is covered separately below, because an audit of it is the more instructive story.

### A gap analysis against Go 1.25

Produced seven modules where Kern was behind: `std.context` for request-scoped cancellation, deadlines and value propagation; `std.unique` for handle-based string interning; `std.synctest` with a fake clock and virtual time for deterministic concurrency tests; `std.fips` for FIPS 140-3 algorithm, key and TLS policy checking; `net.csrf` using Fetch Metadata rather than tokens; and `data.json_stream` for token-by-token and NDJSON processing. Both the CSRF and FIPS modules bridge into the SIEM event pipeline with CWE-117 log sanitization, so a policy violation is an alert, not a log line someone might read.

### Domain work

Landed too: DSP, geospatial, acoustic and DAS fiber-monitoring modules, a PDF writer with images, text metrics and alignment, and MIME multipart attachments for mail. Those arrived with adversarial tests that immediately found two real bugs of their own, an `ifft` that mutated its input and a swapped polynomial in the WGS84 to RD projection, both fixed.