Find the right cryptography library

Before adding a cryptography dependency, establish which protocol and runtime your application targets. A familiar repository name is not enough to show that a library is appropriate for your application.

Start with the protocol

QRL v1 uses XMSS. Its one-time signature state is an application concern as well as a cryptographic one. Read the library documentation and the wallet’s state-management approach before integrating signing.

The qrllib repository is the QRL core library. The organisation also maintains go-qrllib, described as a Go implementation of the QRL cryptographic library.

Make compatibility explicit

Record the selected repository, release or commit, supported runtime, and target protocol in your project. Check these against the actual repository documentation; language alone does not establish protocol compatibility.

Dependency review
  Repository       → upstream source
  Revision         → exact release or commit
  Runtime          → supported toolchain
  Protocol         → intended network and version
  Test vectors     → upstream compatibility checks

Read before wrapping

Review upstream test vectors and error handling before writing an abstraction around a library. A thin, well-tested boundary makes it easier to track upstream changes without hiding essential requirements.

Browse the theQRL organisation for current repositories and their maintenance notes.