Security / Extension

RPCScan PQ extension

Manifest V3 Chromium extension. Status: scaffolded (popup + content script + options page); not yet on the Chrome Web Store.

What it does

Per-tab posture badge. Reads the active tab’s host, queries RPCScan’s /tls/fingerprint, and shows a small popup with the host’s class (pure-PQ / hybrid / classical), group, cipher, score.
One-click "open in RPCScan". Jumps to /explorer/<host> or /rpc/<url> for the active tab.
Pure-PQ launcher reminder. If the popup detects the browser was launched without the --ssl-key-log-additional-keyshare-groups=MLKEM1024 flag, it shows a one-liner with the platform-specific command.
Future: WASM TLS client. Embed our hand-rolled bn-tls stack (ML-KEM-1024 first) compiled to WebAssembly, so the extension itself can negotiate pure-PQ from a content script regardless of the browser’s TLS config.

Load it (developer mode)

The unpacked extension lives in apps/browser-ext/rpcscan-pq/:

# In Chrome / Brave / Edge:
1. chrome://extensions
2. Toggle "Developer mode" on
3. Click "Load unpacked"
4. Select apps/browser-ext/rpcscan-pq/ from this repo

A small RPCScan icon appears in the toolbar. Click it on any tab to see the host’s posture. Pin it for one-click access.

Roadmap

v0.1 (today): popup + options + content script reading public /tls/fingerprint.
v0.2: content-script overlay on rpcscan.info pages: persistent posture badge in the bottom-right corner of every tab.
v0.3: automatic enable of --ssl-key-log-additional-keyshare-groups=MLKEM1024 via launch-helper integration (macOS only initially).
v1.0: WASM-compiled bn-tls negotiating pure-PQ key exchange directly from the extension, bypassing the host browser’s TLS stack for select RPCScan-controlled origins.