Languages and Libraries Supported¶
PostQ supports selected cryptographic APIs in nine source languages. Coverage includes discovery, available algorithm and parameter details, and applicable assessments. It varies by library and source pattern: a supported language does not mean every cryptographic use in that language can be identified or fully assessed.
Coverage at a glance¶
| Language | Libraries and API families covered |
|---|---|
| Java | JCA/JCE, Bouncy Castle, Nimbus JOSE + JWT, JJWT, Apache Commons Codec, Spring Security, Spring Vault |
| Python | PyCryptodome (Crypto imports), cryptography, hashlib, hmac, cryptojwt, oqs |
| Go | Standard crypto and hash packages, plus selected supplementary x/crypto packages |
| C | OpenSSL, GSKit/ICC, Libgcrypt, liboqs, Nettle |
| C++ | Selected C API uses from the libraries above, plus Crypto++ |
| C# | .NET System.Security.Cryptography |
| JavaScript | Node.js crypto, selected Web Crypto APIs, jsonwebtoken |
| TypeScript | Node.js crypto, selected Web Crypto APIs, jsonwebtoken |
| Rust | RustCrypto, ring, rustls, pqcrypto-kyber |
The list describes supported subsets. It does not promise complete coverage of a library, every version, or every assessment. Check the source and settings reported for your application before relying on a result.
Java¶
JCA/JCE and Bouncy Castle coverage includes selected cryptographic operations, transformations, keys, digests, and security settings. Supported local setup can explain later calls. Custom wrappers, reflection, and construction spread across files can leave context unresolved. A requested provider does not establish the provider installed in production or its validation.
Nimbus JOSE + JWT and JJWT provide selected token signing, encryption, and configuration coverage. Apache Commons Codec coverage includes selected digest and encoding calls; the application's security purpose still matters.
Spring Security coverage includes selected BCrypt, PBKDF2, Argon2, scrypt, and legacy password encoders, constructor settings, version-named presets, Encryptors, and KeyGenerators. A preset name describes requested settings, not the installed library version. Custom encoders and settings changed through unsupported paths need review.
Spring Vault coverage concerns selected client-side cryptographic and configuration calls. The remote service's effective key and security configuration require separate evidence.
Supported Java settings can also be read from unambiguous project .properties values; see
Values traced through source.
Python¶
PyCryptodome and cryptography coverage includes selected ciphers, keys, hashes, message authentication, derivation, and authenticated-encryption settings. hashlib and hmac provide supported digest and MAC identities and arguments. Opaque key objects and runtime options can leave parameters unknown.
cryptojwt coverage includes selected JWS, JWE, and JWT construction and use with explicit keyword settings. oqs coverage includes selected key-establishment, signature, and stateful-signature operations. PostQ does not establish remote key settings, safe stateful-key management, or the algorithms enabled in a deployed native library.
Go¶
Selected crypto, hash, and x/crypto calls provide algorithm, key-size, derivation, and other explicit setting information. Supported local relationships, such as AES setup used to create a GCM operation, can make earlier settings available for review.
Custom interfaces, closures, and runtime configuration can limit what PostQ establishes.
C and C++¶
Coverage includes selected OpenSSL encryption, key, digest, derivation, and protocol APIs; GSKit/ICC cryptographic and digest operations; Libgcrypt cipher, hash, MAC, derivation, and public-key calls; liboqs key-establishment and signature operations; and Nettle cipher, hash, MAC, derivation, RSA, and Ed25519 uses.
Crypto++ coverage applies to selected C++ classes, templates, filters, and settings. C++ support for C libraries is limited to covered call forms. The supported C/C++ patterns require the relevant direct library headers; indirect includes and custom wrappers can reduce discovery.
Function pointers, pointer aliases, custom pipelines, and runtime provider choices can leave settings unresolved. Detecting a context-copy call does not by itself establish which settings were copied. The scan does not prove that a cryptographic call succeeded or that its result was handled correctly.
C# and .NET¶
Selected System.Security.Cryptography operations provide algorithm, property, key, password-derivation, and authentication-tag information. Supported local constructors and factories can explain settings for later HMAC and IncrementalHash operations.
Platform implementations, subclasses, asynchronous flows, and settings changed indirectly can need additional review. A .NET API name does not establish provider validation.
JavaScript and TypeScript¶
Selected Node.js crypto and Web Crypto calls provide cryptographic identities and available option values. jsonwebtoken coverage includes selected imported sign, verify, and decode calls with explicit options.
Dynamic objects, spread options, callbacks, and runtime configuration can limit parameter review. Token decoding does not establish signature verification or prove that verification is bypassed. Issuer, audience, expiry, and the application's full authentication path need separate review.
Rust¶
Selected RustCrypto primitives, builders, and parameter sets, ring operations, rustls protocol settings, and pqcrypto-kyber key-establishment calls provide discovery and review context.
Macros, generic interfaces, wrappers, and unsupported object relationships can limit the available evidence. Configured TLS does not establish the negotiated connection. A Kyber package name does not establish conformance to standardized ML-KEM.
Set expectations for your application¶
Start with a representative scan and compare the detected inventory with the cryptographic dependencies your team knows about. An identified library can still have unknown algorithms or settings. Unsupported source forms and runtime-only values should remain review questions.
See Cryptographic Discovery and Inventory for how PostQ explains source settings and Assessment Dimensions for what the available evidence can support. Language-selection controls are documented under Running Scans; operating-system requirements are in Platform Support.