This paper presents QuanChan, a full-stack, post-quantum anonymous communication platform that builds upon the secure storage backend introduced in Part I. As NIST finalizes its first post-quantum cryptography (PQC) standards, the engineering challenge has shifted from theoretical implementation to real-world, deployable web applications. QuanChan addresses this by moving the cryptographic trust boundary directly into the user's browser. Key architectural features and contributions include: Browser-Resident Identity: User identity is rooted locally using ML-DSA-87, allowing deterministic cross-device recovery via a 12-word seed phrase without centralized username/password databases. Post-Quantum Direct Messaging: Client-side encryption utilizing ML-KEM-1024 for key encapsulation and AES-256-GCM for payload encryption ensures message secrecy independent of server trust. Application-Layer Integrity: Dilithium5-signed thread and message snapshots allow the frontend WASM module to independently verify content integrity. Cryptographic Honesty in Transport: Addresses real-world proxy challenges (e.g., Cloudflare TLS termination) by introducing runtime disclosure endpoints (/api/crypto/tls-proof) that report actual observed handshake properties rather than relying on assumed static configurations. Identity-Bound Moderation: Introduces an auditable, role-based moderation system (including founder tokens and persistent badges) tied entirely to stable cryptographic identity hashes. By integrating these standardized PQC primitives across the identity, messaging, and operational layers, QuanChan serves as a practical engineering case study for deploying verifiable, quantum-safe applications in modern proxied environments.
Sujith B (Sun,) studied this question.