crypt_guard 2.0.0

CryptGuard is a post-quantum cryptography framework with NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA) plus legacy Kyber/Falcon/Dilithium, combined with AES and XChaCha20.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

workspace = { members = [ "crypt_guard_proc"], exclude = ["old"] }
[package]
name = "crypt_guard"
version = "2.0.0"
edition = "2021"
description = "CryptGuard is a post-quantum cryptography framework with NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA) plus legacy Kyber/Falcon/Dilithium, combined with AES and XChaCha20."
license = "MIT"
repository = "https://github.com/mm9942/crypt_guard"

[features]
# Phase 4 complete: the safe ML-KEM + ML-DSA path is the default build.
# Legacy compatibility remains opt-in via `--features legacy-pqclean`.
default = [
    "ml-kem-backend",
    "ml-dsa-backend",
]

# ── New FIPS backends (Phase 2) ───────────────────────────────────────────────
ml-kem-backend  = ["dep:ml-kem"]
ml-dsa-backend  = ["dep:ml-dsa"]
sign-slhdsa     = ["dep:slh-dsa"]
# preview         = ["dep:hqc", "dep:falcon-rs"]

# ── Legacy pqcrypto path ───────────────────────────────────────────────────────
# legacy-pqclean pulls in all the symmetric cipher, archive, and zip features
# so that --no-default-features --features legacy-pqclean gives a fully functional
# build identical to the pre-Phase-1 baseline.
legacy-pqclean = [
    "dep:pqcrypto-kyber",
    "dep:pqcrypto-falcon",
    "dep:pqcrypto-dilithium",
    "dep:pqcrypto-traits",
    "aes-gcm-siv-cipher",
    "xchacha20poly1305-cipher",
    "archive",
    "zip",
    "aes-ctr",
    "aes-xts",
    "legacy-aes",
]

# ── Symmetric cipher features ─────────────────────────────────────────────────
# aes-gcm-siv and xchacha20poly1305 use names with -cipher suffix to avoid
# conflicting with the future Phase 2 FIPS feature names.
aes-gcm-siv-cipher      = []   # dep already unconditional; gating in Phase 2
xchacha20poly1305-cipher = []  # same

aes-ctr      = ["dep:ctr"]
aes-xts      = ["dep:xts-mode"]
legacy-aes   = ["dep:aes", "dep:cbc", "dep:block-padding"]

# ── Archive / zip features ─────────────────────────────────────────────────────
archive = ["dep:tar", "dep:xz2", "dep:flate2", "dep:walkdir"]
zip     = ["dep:zip"]

# ── zeroize is unconditional — NOT gated ──────────────────────────────────────

[dependencies]
# ── Always-on (unconditional) ─────────────────────────────────────────────────
hex              = "0.4.3"
tracing          = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "registry", "time"] }
tracing-appender = "0.2"
hmac             = "0.12.1"
rand             = "0.8.5"
sha2             = "0.10.8"
chacha20         = "0.9.1"
once_cell        = "1"
crypt_guard_proc = { path = "./crypt_guard_proc", version = "0.2.0" }
zeroize          = { version = "1.8.1", features = ["derive"] }
digest           = "0.10.7"
generic-array    = "1.1.0"
aes-gcm-siv      = "0.11.1"
chacha20poly1305 = "0.10.1"
chrono           = "0.4.37"
# hkdf is unconditional: the KDF module is always compiled in the new path
hkdf             = "0.13.0"

# ── Optional: New FIPS backends ───────────────────────────────────────────────
ml-kem  = { version = "0.3.2", optional = true, features = ["zeroize"] }
ml-dsa  = { version = "0.1.1", optional = true, features = ["zeroize", "rand_core"] }
slh-dsa = { version = "0.2.0-rc.5", optional = true }

# ── Optional: legacy pqcrypto deps ────────────────────────────────────────────
pqcrypto-falcon    = { version = "0.3.0",  optional = true }
pqcrypto-traits    = { version = "0.3.5",  optional = true }
pqcrypto-dilithium = { version = "0.5.0",  optional = true }
pqcrypto-kyber     = { version = "0.8.1",  optional = true }

# ── Optional: cipher deps ──────────────────────────────────────────────────────
aes           = { version = "0.8.4",  optional = true }
block-padding = { version = "0.3.3",  optional = true }
cbc           = { version = "0.1.2",  optional = true, features = ["alloc", "std"] }
ctr           = { version = "0.9.2",  optional = true }
xts-mode      = { version = "0.5.1",  optional = true }

# ── Optional: archive/zip deps ────────────────────────────────────────────────
xz2     = { version = "0.1.7",  optional = true, features = ["static"] }
tar     = { version = "0.4.43", optional = true }
flate2  = { version = "1.0.35", optional = true }
walkdir = { version = "2.5.0",  optional = true }
zip     = { version = "2.2.2",  optional = true }
rand_core_010 = { version = "0.10", package = "rand_core" }
sha2_011 = { version = "0.11", package = "sha2" }
getrandom = { version = "0.4.2", features = ["std"] }

[dev-dependencies]
tempfile = "3.10.1"
trybuild = "1.0.103"

# ── Example declarations ─────────────────────────────────────────────────────
[[example]]
name = "encrypt_aes"
path = "examples/encrypt_aes.rs"
required-features = ["ml-kem-backend"]

[[example]]
name = "encrypt_xchacha"
path = "examples/encrypt_xchacha.rs"
required-features = ["ml-kem-backend"]

[[example]]
name = "macro_example"
path = "examples/macro_example.rs"
required-features = ["legacy-pqclean"]

[[example]]
name = "signed_message"
path = "examples/signed_message.rs"
required-features = ["legacy-pqclean"]