crypt_guard 2.0.4

CryptGuard is a post-quantum cryptography framework with NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA) plus legacy Kyber/Falcon/Dilithium, combined with AES and XChaCha20.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

workspace = { members = [ "crypt_guard_proc"], exclude = ["old"] }
[package]
name = "crypt_guard"
version = "2.0.4"
edition = "2021"
description = "CryptGuard is a post-quantum cryptography framework with NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA) plus legacy Kyber/Falcon/Dilithium, combined with AES and XChaCha20."
license = "MIT"
repository = "https://github.com/mm9942/crypt_guard"

[features]
# Phase 4 complete: the safe ML-KEM + ML-DSA path is the default build.
# Legacy compatibility remains opt-in via `--features legacy-pqclean`.
default = [
    "ml-kem-backend",
    "ml-dsa-backend",
]

# ── New FIPS backends (Phase 2) ───────────────────────────────────────────────
ml-kem-backend  = ["dep:ml-kem"]
ml-dsa-backend  = ["dep:ml-dsa"]
sign-slhdsa     = ["dep:slh-dsa"]
# Experimental, revision-pinned public support for draft-ietf-hpke-pq-05.
# This remains separate from the existing CGv2 ML-KEM backend. It exposes only
# the two vector-gated Base-mode profiles; it is not an RFC-standardized HPKE
# profile and makes no permanent interoperability claim.
hpke-pq-draft-05 = ["dep:aes-gcm", "dep:libcrux-ml-kem", "dep:sha3"]
# preview         = ["dep:hqc", "dep:falcon-rs"]

# ── Legacy pqcrypto path ───────────────────────────────────────────────────────
# legacy-pqclean pulls in all the symmetric cipher, archive, and zip features
# so that --no-default-features --features legacy-pqclean gives a fully functional
# build identical to the pre-Phase-1 baseline.
legacy-pqclean = [
    "dep:pqcrypto-kyber",
    "dep:pqcrypto-falcon",
    "dep:pqcrypto-dilithium",
    "dep:pqcrypto-traits",
    "aes-gcm-siv-cipher",
    "xchacha20poly1305-cipher",
    "archive",
    "zip",
    "aes-ctr",
    "aes-xts",
    "legacy-aes",
]

# ── Symmetric cipher features ─────────────────────────────────────────────────
# aes-gcm-siv and xchacha20poly1305 use names with -cipher suffix to avoid
# conflicting with the future Phase 2 FIPS feature names.
aes-gcm-siv-cipher      = []   # dep already unconditional; gating in Phase 2
xchacha20poly1305-cipher = []  # same

aes-ctr      = ["dep:ctr"]
aes-xts      = ["dep:xts-mode"]
legacy-aes   = ["dep:aes", "dep:cbc", "dep:block-padding"]

# ── Archive / zip features ─────────────────────────────────────────────────────
archive = ["dep:tar", "dep:xz2", "dep:flate2", "dep:walkdir"]
zip     = ["dep:zip"]

# ── zeroize is unconditional — NOT gated ──────────────────────────────────────

[dependencies]
# ── Always-on (unconditional) ─────────────────────────────────────────────────
hex              = "0.4.3"
tracing          = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "registry", "time"] }
tracing-appender = "0.2"
hmac             = "0.12.1"
rand             = "0.8.5"
sha2             = "0.10.8"
chacha20         = "0.9.1"
once_cell        = "1"
# The proc-macro crate is released in lockstep with this crate's v2 line.
crypt_guard_proc = { path = "./crypt_guard_proc", version = "2.0.4" }
zeroize          = { version = "1.8.1", features = ["derive"] }
digest           = "0.10.7"
generic-array    = "1.1.0"
aes-gcm-siv      = "0.11.1"
chacha20poly1305 = "0.10.1"
chrono           = "0.4.37"
# hkdf is unconditional: the KDF module is always compiled in the new path
hkdf             = "0.13.0"

# ── Optional: New FIPS backends ───────────────────────────────────────────────
ml-kem  = { version = "0.3.2", optional = true, features = ["zeroize"] }
# PQCA/PQCP ML-KEM backend for the standards-track HPKE path. Pin exactly so
# the reviewed validation and serialization contract cannot change unnoticed.
libcrux-ml-kem = { version = "=0.0.9", optional = true, default-features = false, features = ["std", "mlkem768", "mlkem1024"] }
# Used only by the explicitly experimental draft-ietf-hpke-pq-05 path.  These
# are the RFC 9180 registered AES-GCM AEADs, not the crate's CGv2 GCM-SIV API.
aes-gcm = { version = "=0.11.0", optional = true }
sha3 = { version = "=0.11.0", optional = true }
ml-dsa  = { version = "0.1.1", optional = true, features = ["zeroize", "rand_core"] }
slh-dsa = { version = "0.2.0-rc.5", optional = true }

# ── Optional: legacy pqcrypto deps ────────────────────────────────────────────
pqcrypto-falcon    = { version = "0.3.0",  optional = true }
pqcrypto-traits    = { version = "0.3.5",  optional = true }
pqcrypto-dilithium = { version = "0.5.0",  optional = true }
pqcrypto-kyber     = { version = "0.8.1",  optional = true }

# ── Optional: cipher deps ──────────────────────────────────────────────────────
aes           = { version = "0.8.4",  optional = true }
block-padding = { version = "0.3.3",  optional = true }
cbc           = { version = "0.1.2",  optional = true, features = ["alloc", "std"] }
ctr           = { version = "0.9.2",  optional = true }
xts-mode      = { version = "0.5.1",  optional = true }

# ── Optional: archive/zip deps ────────────────────────────────────────────────
xz2     = { version = "0.1.7",  optional = true, features = ["static"] }
tar     = { version = "0.4.43", optional = true }
flate2  = { version = "1.0.35", optional = true }
walkdir = { version = "2.5.0",  optional = true }
zip     = { version = "2.2.2",  optional = true }
rand_core_010 = { version = "0.10", package = "rand_core" }
sha2_011 = { version = "0.11", package = "sha2" }
getrandom = { version = "0.4.2", features = ["std"] }

[dev-dependencies]
serde = { version = "=1.0.228", features = ["derive"] }
serde_json = "=1.0.150"
tempfile = "3.10.1"
trybuild = "=1.0.117"

# ── Example declarations ─────────────────────────────────────────────────────
[[example]]
name = "encrypt_aes"
path = "examples/encrypt_aes.rs"
required-features = ["ml-kem-backend"]

[[example]]
name = "encrypt_xchacha"
path = "examples/encrypt_xchacha.rs"
required-features = ["ml-kem-backend"]

[[example]]
name = "macro_example"
path = "examples/macro_example.rs"
required-features = ["legacy-pqclean"]

[[example]]
name = "signed_message"
path = "examples/signed_message.rs"
required-features = ["legacy-pqclean"]