Payments
ISO 20022, end to end: pain.001, pacs.008, camt.053, and acmt.001. Adopt one library at a time.
Explore the ISO 20022 librariesPayments and digital products, built at:
# 1. Validate ISO 20022 pacs.008.001.10 (pip install pacs008)
pacs008 -t pacs.008.001.10 -m template.xml -s schema.xsd -d payments.csv --dry-run
✓ Schema validation passed
✓ Data validation passed (1 payment records)
# 2. Verify NIST FIPS 203 ML-KEM-768 KEM (cargo add kyberlib)
cargo test -p kyberlib --test test_kem
✓ test keypair_encap_decap ... ok
✓ test result: ok. 9 passed; 0 failed; finished in 0.01s
# 3. Verify live CycloneDX SBOM provenance (SLSA / Sigstore)
curl -sSLO https://sebastienrousseau.com/sbom.cdx.json && gh attestation verify sbom.cdx.json --owner sebastienrousseau
✓ Loaded 1 attestation from GitHub API (slsa.dev/provenance/v1)
✓ Verification succeeded!What I build
Open-source foundations for wholesale finance.
Security
Post-quantum primitives: ML-KEM (CRYSTALS-Kyber, NIST FIPS 203) and hashing, ready to pilot today.
See the post-quantum primitivesTooling
Audited Rust libraries and a code security scanner, signed and shipped with a software bill of materials.
View the toolingProof
By the numbers.
53.0M All-time downloads
3.7M Downloads, last 30 days
736 GitHub stars
179 Packages published
Most downloads come from transitive dependencies in CI/CD pipelines and production services across PyPI, crates.io, and npm · Updated .
Recognition
Recognition and featured work.
EPAA · September 2025
Why the payments industry must act now.
Regulators are treating harvest-now-decrypt-later as a credible present risk. This paper, produced for the Emerging Payments Association Asia, sets out the structural threat and the case for coordinated action across wholesale payment rails.
- Fellow of the Institution of Analysts and Programmers (FIAP)
- Mobile Agency of the Year
- Agency of the Year
- Best Branded Social TV Award
- Best 2nd Screen Experience for TV on Mobile or Tablet (Shazam for TV)
Latest
From the desk.
AI · AI Governance · Compliance
Why the FCA Is Regulating AI Without an AI Rulebook
TL;DR Why the FCA regulates AI through its existing principles-based, outcomes-focused rules rather than an AI rulebook, and where governance may need to adapt.
Cybersecurity · Cryptography · AI
The Mystery Seeds Behind NIST's Curves Were Never Hashes, and Claude Found Out in Under Half an Hour
TL;DR Why the seeds behind NIST's P-256 and related curves came from lrand48, not hashes, how Claude found out in under half an hour, and why it is not a break.
AI · Agentic AI · Generative AI
Agentic AI breaks the assumption behind every task-exposure forecast
TL;DR Why agentic AI breaks task-exposure forecasts that assume jobs survive automation, and how the Agentic Task Exposure score measures workflow coverage.