Metadata-Version: 2.4
Name: ciphersafe-crypto
Version: 0.1.0
Summary: Safe Cryptographic Primitives for Developers - Secure defaults, post-quantum support, compliance auditing
Author: CipherForge Contributors
License: Apache-2.0
Keywords: cryptography,security,encryption,post-quantum,privacy,compliance
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=41.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: pytest-cov>=4.0; extra == "dev"
Requires-Dist: ruff>=0.1.0; extra == "dev"
Provides-Extra: pqc
Requires-Dist: liboqs-python>=0.8; extra == "pqc"
Dynamic: license-file

# CipherForge

**Safe Cryptographic Primitives for Developers**

[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)

CipherForge is an open-source cryptographic toolkit that makes it easy to use cryptography correctly. It provides safe defaults, bans insecure algorithms, and includes post-quantum migration paths — so developers can't accidentally get crypto wrong.

## Why CipherForge?

**95% of web applications have at least one cryptographic misconfiguration** (Veracode 2024). Most developers aren't crypto experts, yet they're expected to implement crypto correctly. CipherForge eliminates this gap by:

- **Banning insecure algorithms** — MD5, SHA-1, DES, 3DES, RC4 are all blocked at the API level
- **Enforcing safe defaults** — AES-256-GCM, Ed25519, PBKDF2 with 600K iterations
- **Post-quantum ready** — ML-KEM, ML-DSA, SLH-DSA integration via liboqs
- **Compliance auditing** — Scans codebases for crypto misuse (NIST SP 800-57, CNSA 2.0, OWASP)

## Quick Start

```bash
pip install cipherforge

# Hash (safe algorithms only)
cipherforge hash "my secret data" --algo sha256

# Encrypt (AES-256-GCM with proper KDF)
cipherforge encrypt --password "my-password" -o secret.enc sensitive.txt

# Generate keys
cipherforge keygen --algo ed25519 -o ./keys

# Scan code for crypto issues
cipherforge audit ./my-project

# Check compliance
cipherforge compliance ./my-project

# PQC info
cipherforge pqc info
```

## Commands

| Command | Description |
|---------|-------------|
| `cipherforge hash` | Generate cryptographic hashes (SHA-256/384/512, BLAKE2b) |
| `cipherforge encrypt` | Encrypt with AES-256-GCM (safe defaults) |
| `cipherforge decrypt` | Decrypt AES-256-GCM encrypted data |
| `cipherforge sign` | Sign with Ed25519 |
| `cipherforge verify` | Verify Ed25519 signatures |
| `cipherforge keygen` | Generate key pairs (Ed25519, X25519, PQC) |
| `cipherforge audit` | Scan code for insecure crypto patterns |
| `cipherforge compliance` | Check NIST/CNSA 2.0/GDPR compliance |
| `cipherforge pqc` | Post-quantum cryptography operations |

## Security Guarantees

CipherForge enforces these standards by default:

| Category | CipherForge | Typical Mistake |
|----------|-------------|-----------------|
| Symmetric encryption | AES-256-GCM | DES, 3DES, RC4, ECB mode |
| Hashing | SHA-256+ or BLAKE2b | MD5, SHA-1 |
| Key derivation | PBKDF2-SHA512 (600K iter) | MD5(password) |
| Asymmetric | Ed25519, X25519 | RSA-1024, ECDSA-P192 |
| RNG | os.urandom(), secrets | random.random() |
| Password hashing | bcrypt, scrypt, Argon2id | SHA256(password) |
| Signatures | Ed25519 | DSA, RSA-1024 |

## Post-Quantum Cryptography

CipherForge includes support for all NIST FIPS 203/204/205 standardized algorithms:

- **ML-KEM (Kyber)** — Key encapsulation for key exchange
- **ML-DSA (Dilithium)** — Digital signatures
- **SLH-DSA (SPHINCS+)** — Hash-based signatures (defense in depth)

```bash
# See PQC algorithm recommendations
cipherforge pqc info

# Generate PQC keys (requires liboqs)
pip install cipherforge[pqc]
cipherforge pqc keygen
```

## Configuration

```json
{
  "banned_algorithms": ["md5", "sha1", "des", "3des", "rc4"],
  "min_rsa_bits": 4096,
  "min_ecdsa_bits": 384,
  "enforce_pqc": false
}
```

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

## License

Apache License 2.0 — see [LICENSE](LICENSE).
