zcrypt — Post-Quantum Cryptography Toolkit

Hybrid classic + post-quantum cryptography in C11. Ed25519/X25519 + ML-DSA-65/ML-KEM-768, PKI with certificate authorities, streaming encryption, MAC binding, encrypted key vault with backup/recovery, key rotation, and certificate renewal.

Features

• Hybrid PQ crypto: Ed25519 + ML-DSA-65 signatures, X25519 + ML-KEM-768 KEM
• PKI with CA hierarchy: Root CAs, sub-CAs, chain validation via provider sign
• Streaming encryption: Chunked AEAD for large files (format v0x02)
• MAC binding: Auto-capture machine MAC into certificates for enhanced authentication
• Protected keys: Per-entry password-encrypted secret keys in vault
• Backup & recovery: 256-bit backup key for vault recovery without password
• Key rotation: Generate new key pair while keeping old keys for decryption
• Certificate renewal: Extend expiry and re-sign certificates
• Certificate Revocation Lists: Revoke individual certificates by public key hash
• Custom crypto implementations: Ed25519, X25519, XChaCha20, Poly1305, SHA3, Argon2 with AVX2 acceleration

Security Hardening

• Secret zeroing: All key material zeroed with explicit_bzero() on all code paths
• Constant-time operations: Timing side-channel resistant comparisons
• mlock: Vault keys locked in memory to prevent disk swap
• Atomic writes: Crash-safe vault persistence (tmp + fsync + rename)
• Stack protection: -fstack-protector-strong, _FORTIFY_SOURCE=3
• Sanitizers: ASan + UBSan + LeakSanitizer in debug builds
• Strict warnings: -Wall -Wextra -Wpedantic -Werror
• Input validation: All API functions validate inputs at entry

Quick Start

# Build
cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug
cmake --build build -j$(nproc)

# Create vault
./build/src/cli/zcrypt --vault vault.z --password secret vault init

# Create CA
./build/src/cli/zcrypt --vault vault.z --password secret provider create myCA --out myCA.z

# Create + sign cert
./build/src/cli/zcrypt --vault vault.z --password secret cert create alice
./build/src/cli/zcrypt --vault vault.z --password secret cert sign cert_alice.z --provider myCA

# Encrypt / Decrypt
echo "hello" | ./build/src/cli/zcrypt --vault vault.z --password secret encrypt - --to cert_alice.z
./build/src/cli/zcrypt --vault vault.z --password secret decrypt encrypted.z

Docs: docs/build.md · docs/cli.md · docs/api.md · docs/architecture.md

License: MIT