qids — Python client for QIDS quantum digital signatures

qids is the Python client SDK for a QIDS Gateway. The gateway signs documents with one-time universal hashing (OTUH), a quantum digital signature scheme, and verifies them for the designated recipients. This package sends the requests; the gateway holds the one-time key material, and the client never sees it.

pip install qids

Python 3.10 or later. It depends on nothing outside the standard library.

The gateway itself is not on PyPI. It is delivered as a licensed container image. For access, contact raunakg2005@gmail.com.

Sign and verify

from qids import QIDSClient

client = QIDSClient(
    node_id="bank_node_alpha",
    qids_service_url="https://your-gateway.example.com",
    api_key="sk_live_...",   # from <gateway>/signup
)

signature = client.sign(
    document_id="DOC-98104",
    payload=b"TRANSFER 1,000,000 USD TO ACCT-48910",
    recipient_ids=["bank_node_beta"],
)
print(signature.document_id, len(signature.signature_tags), "tag(s)")
print(signature.entropy_source, "qkd_backed =", signature.qkd_backed)

verification = client.verify(
    document_id=signature.document_id,
    payload=b"TRANSFER 1,000,000 USD TO ACCT-48910",
    sender_id="bank_node_alpha",
    signature_tag=signature.signature_tags[0],
)
print(verification.is_valid, verification.reason, verification.threat)

A changed payload is rejected, and the result names the threat (forgery).

What a signature guarantees

The forgery bound returned with each signature (signature.otuh) is information-theoretic for a one-time key that is uniformly random and secret, so where the key comes from matters, and every signature says (entropy_source, qkd_backed):

• Key from a QKD system over ETSI GS QKD 014: the guarantee holds end to end.
• Key from the OS CSPRNG (the default): the guarantee rests on that generator and is computational in practice.

The gateway deals the recipients' key shares itself, so it is a trusted dealer: its guarantees are only as strong as the host it runs on.

Errors

QIDSAuthError (a missing or rejected API key) and QIDSServiceError (the gateway returned an error or could not be reached) come from qids.client. The QidsError hierarchy in qids.errors lets you catch everything the package raises deliberately.

ETSI GS QKD 014

QIDSClient(..., etsi_kms_url=...) and client.get_etsi_client(peer_sae_id) give direct access to a key-management entity through the ETSI GS QKD 014 REST API (qids.hardware.etsi_014.ETSI014Client).

Licence

Proprietary. Copyright © 2026 QIDS. All rights reserved. See LICENSE in the distribution.