QAVACH is a next-generation digital service delivery framework designed for the future of Indian e-governance. It addresses the "Triple Threat" of modern digital states—Data Integrity, Availability, and Privacy—by implementing a Zero-Trust Architecture powered by NIST-standardized Post-Quantum Cryptography (PQC).
QAVACH decentralizes proofs using Policy-Gated Credential Attestation (PGCA), where verification happens on the citizen's device, not a server. By decoupling Identity from Attestation, citizens can prove eligibility without sharing the original document or PII.
Provides a real-time compliance dashboard for government CISOs to track the migration of state departments to PQC. The system exposes which departments are using vulnerable classical algorithms versus resilient PQC algorithms.
The verifier transmits an Open Policy Agent (OPA) Compiled Policy (WASM) and a unique challenge (nonce).
The QAVACH app executes this policy against the citizen's decrypted record in a local secure context.
The resulting signature (ML-DSA-44) mathematically proves that a trusted document satisfied a specific policy without revealing any document attributes to the verifier.
Constituting three layers, GovSign - a singlle API that any government calls to issue creds, The CBOM dashboard - A Crypto bill of services, and QAVACH - the citizen wallet.
Acts as a secure container for citizen credentials. It uses an On-Device Policy Engine to run Open Policy Agent (OPA) Rego policies to evaluate claims locally.
Used for key encapsulation in secure document storage. It enables the derivation of a shared symmetric key (AES-256).
Used for citizen attestation and real-time signing, providing a balance of signature size and computational efficiency.
Stateless hash-based signatures used for long-term document archival. It relies solely on the security of the underlying cryptographic hash function.
Documents are stored in a Locked and Encrypted state where a unique AES-256-GCM key is encapsulated via ML-KEM-768 using the citizen's public key.
SLH-DSA allows for signature verification without needing to maintain complex state, simplifying disaster recovery.
All communications are over TLS, and signed QR challenges ensure portal authenticity.
"The impending 'Quantum Harvest' (Store now, Decrypt later) threat makes today's RSA and ECDSA-based signatures vulnerable to future decryption."
"We assume the network is hostile and that central databases are primary targets."