reallyme-crypto

ReallyMe Crypto provides a platform-agnostic cryptography API for Rust, Swift, Kotlin, and TypeScript. Applications can implement cryptographic logic once and rely on identical algorithms, key formats, and verification behavior across servers, Apple platforms, Android, browsers, and WASM. Native platform providers are used where appropriate, while shared conformance vectors ensure byte-for-byte compatible behavior across every supported language.

[!NOTE] Status: Early public release (0.1.x). Public APIs and wire contracts are documented in CONTRACT.md and evolve through explicit versioned releases.

Why

Modern cryptography APIs differ across platforms. Algorithms are exposed differently, key formats vary, providers have different capabilities, and error behavior is inconsistent.

ReallyMe Crypto provides a consistent cryptography contract across all supported platforms. The same application logic can be shared between backend services, mobile applications, and browsers without maintaining separate cryptographic implementations. Provider selection is always explicit, verification fails closed, and unsupported algorithms return typed errors instead of silently falling back to another implementation.

Packages

Supported Algorithms

X-Wing-768 follows the IETF CFRG Internet-Draft draft-connolly-cfrg-xwing-kem, which defines a hybrid KEM built from X25519 and ML-KEM-768. X-Wing-1024 uses the same combiner shape with ML-KEM-1024.

The exact per-language provider map lives in PROVIDER_POLICY.md. For each language lane, an algorithm is either handled by its declared provider or rejected with a typed unsupported-algorithm error.

RSA support is intentionally verification-only for X.509, eMRTD, and legacy PKI interoperability. The package does not generate RSA keys, sign with RSA private keys, or provide RSA encryption/decryption APIs.

Install

Rust

cargo add reallyme-crypto --features native,dispatch,ed25519

Codec-only consumers:

cargo add reallyme-codec

Swift

.package(
    url: "https://github.com/reallyme/crypto",
    from: "0.1.1"
)

.product(name: "ReallyMeCrypto", package: "crypto")

Kotlin

dependencies {
    implementation("me.really:crypto:0.1.1")
}

TypeScript

npm install @reallyme/crypto

For production deployments, pin exact package versions, release tags, or Git revisions so cryptographic behavior and conformance vectors remain identical across all language lanes.

Quick Start

Rust:

use reallyme_crypto::core::Algorithm;
use reallyme_crypto::dispatch::{generate_keypair, sign, verify};

let (public_key, secret_key) = generate_keypair(Algorithm::Ed25519)?;
let signature = sign(Algorithm::Ed25519, &secret_key, b"message")?;
verify(Algorithm::Ed25519, &public_key, b"message", &signature)?;
# Ok::<(), reallyme_crypto::dispatch::AlgorithmError>(())

Swift:

import ReallyMeCrypto

let digest = try ReallyMeCrypto.hash(.sha2_256, Array("abc".utf8))

Kotlin:

import me.really.crypto.ReallyMeCrypto
import me.really.crypto.ReallyMeHashAlgorithm

val digest = ReallyMeCrypto.hash(ReallyMeHashAlgorithm.SHA2_256, "abc".toByteArray())

TypeScript:

import { ReallyMeCrypto } from "@reallyme/crypto";

const digest = ReallyMeCrypto.hash("SHA2-256", new TextEncoder().encode("abc"));

Signature verification fails closed: an invalid signature returns an error rather than a boolean that can be accidentally ignored.

Protobuf

The importable wire/config contract lives at proto/reallyme/crypto/v1/crypto.proto. Service, application, and storage protos can import it when they need stable crypto algorithm identifiers.

The generated proto adapters are available through:

See docs/protobuf.md for the boundary rules and adapter policy.

Documentation

• PROVIDER_POLICY.md — provider matrix and backend selection for every algorithm and lane.
• CONTRACT.md — the public package and wire contract.
• docs/jwk.md — JWK and multikey encoding.
• docs/protobuf.md — protobuf identifiers and boundary rules.
• docs/conformance.md — running the conformance vectors.
• docs/dependency-updates.md — dependency update policy and Renovate review rules.
• docs/rust-publishing.md — publishing the Rust crates.
• SECURITY.md, SECURITY_MEMORY_MODEL.md — reporting security issues and how secret material is handled.

Security Rules

This repository is security-sensitive code. The project policy is:

• no panics, unwraps, or generic string errors in production paths;
• typed errors only;
• zeroizing owners for secret material;
• checked arithmetic for buffer sizes and offsets;
• negative tests and conformance vectors for every primitive;
• no silent platform fallback in release platform lanes.

Conformance

Shared vectors live in vectors. The generator and platform verifiers live in crates/conformance/vectors.

The everyday all-feature Rust check is:

cargo nextest run --workspace --all-features

The full release wall is documented in docs/conformance.md.