stenoxide_core/crypto/mod.rs
1//! Layer 2 — cryptography.
2//!
3//! Password-based key derivation (Argon2id), key expansion into independent
4//! subkeys (HKDF-SHA3-512), authenticated encryption (XChaCha20-Poly1305) and
5//! payload compression. Every type that holds key material implements
6//! `ZeroizeOnDrop`.
7//!
8//! The layer is a one-way chain, and each stage narrows what the next one can
9//! do wrong:
10//!
11//! ```text
12//! password + phash --Argon2id--> MasterKey
13//! --HKDF-SHA3-512--> DerivedKeys { enc_key, nonce, stc_seed }
14//! plaintext --zstd--> compressed --XChaCha20-Poly1305--> ciphertext
15//! ```
16
17pub mod aead;
18pub mod expand;
19pub mod kdf;