Metadata-Version: 2.1
Name: saqura
Version: 1.0.9
Summary: =?utf-8?q?SaQura_=E2=80=94_post-quantum-ready_cryptography_for_Python=2E_Wire-compatible_with_SaQura_for_=2ENET=2C_Swift_and_Kotlin=2E?=
Author: KyotoTech LLC
License: Proprietary
Description-Content-Type: text/markdown
Keywords: cryptography,post-quantum,pqc,aes,rsa,saqura,liboqs,ml-dsa,ml-kem
Home-page: https://saqura.de
Project-URL: Homepage, https://saqura.de
Requires-Python: >=3.10
Requires-Dist: cryptography>=42.0
Provides-Extra: quantum
Requires-Dist: liboqs-python>=0.10; extra == "quantum"
Classifier: Topic :: Security :: Cryptography
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13

# SaQura for Python

**Post-quantum-ready cryptography for Python.** Wire-compatible with SaQura for
.NET, Swift and Kotlin — data encrypted or signed on one platform decrypts and
verifies on every other.

SaQura is **async-first** (`await saqura.aes.encrypt(...)`) with a synchronous
facade (`saqura.sync`), mirroring the Swift (`async`) and Kotlin (`suspend`) SDKs.

## Features

| Module | What it does |
|---|---|
| **AES** | AES-256-GCM (auto-detects legacy CBC+HMAC on decrypt) |
| **RSA** | RSA-4096 — OAEP-SHA256 encryption, PSS-SHA256 signatures |
| **Hybrid** | RSA+AES envelope for large payloads (new + legacy `HYBR`) |
| **Quantum** | Post-quantum KEMs (FrodoKEM / Classic-McEliece / ML-KEM, Generations 2–8) and ML-DSA (FIPS 204) / SLH-DSA (FIPS 205) signatures, via [liboqs](https://openquantumsafe.org/) |
| **Licensing** | Offline `.lic` verification (public-key-only) |
| **Password** | PBKDF2-HMAC-SHA512, 210 000 iterations |

## Install

```bash
pip install saqura            # AES / RSA / Hybrid / Licensing / Password
pip install "saqura[quantum]" # + post-quantum (pulls liboqs-python)
```

Requires Python 3.10+. Wheels are shipped compiled (no `.py` source).

> **Windows + post-quantum:** `liboqs-python`'s default MSVC build miscompiles the
> FIPS-205 SLH-DSA path. After installing the `quantum` extra, run the bundled
> helper once — `powershell -ExecutionPolicy Bypass -File tools\setup_liboqs_windows.ps1` —
> to install a correct (clang-cl) `liboqs`. macOS and Linux are unaffected.

## Usage

```python
import asyncio, saqura

async def main():
    # symmetric
    blob = await saqura.aes.encrypt("hello", "my-key")
    assert await saqura.aes.decrypt(blob, "my-key") == "hello"

    # asymmetric — new_key_pair() returns (private_pem, public_pem)
    priv, pub = await saqura.rsa.new_key_pair()
    sig = await saqura.rsa.sign("invoice #42", priv)
    assert await saqura.rsa.verify("invoice #42", sig, pub)

asyncio.run(main())
```

Synchronous facade — same names, no `await`:

```python
import saqura
blob = saqura.sync.aes.encrypt("hello", "my-key")
text = saqura.sync.aes.decrypt(blob, "my-key")
```

## Interoperability

All SaQura libraries share the same wire formats (AES-GCM `nonce‖ct‖tag`,
RSA-OAEP/PSS-SHA256, hybrid envelope, FrodoKEM / Classic-McEliece / ML-KEM blobs,
ML-DSA / SLH-DSA signatures, PBKDF2-SHA512, `.lic` license files). Cross-language
round-trips are verified against a shared test corpus, so a `.lic` issued for
.NET validates in Python and an AES blob from Swift decrypts in Python.

---

© 2025–2026 KyotoTech LLC. Proprietary.
