Metadata-Version: 2.4
Name: sqrypt-cyber-sdk
Version: 2.0.0
Summary: Enterprise Post-Quantum Cybersecurity SDK and CBOM Auditing Suite
Author: Aryan Sujay
License: MIT
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Classifier: Environment :: Console
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=42.0.0
Requires-Dist: requests>=2.31.0
Requires-Dist: fpdf==1.7.2
Requires-Dist: tqdm>=4.66.0
Requires-Dist: rich>=13.0.0
Dynamic: license-file

<div align="center">

# SQrypt

**Post-Quantum Cryptographic Security Suite**

*Hybrid encryption SDK + Cryptographic Bill of Materials (CBOM) auditing engine, built for the "Harvest Now, Decrypt Later" threat era*

[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
[![Python](https://img.shields.io/badge/python-3.8%2B-blue.svg)](pyproject.toml)
[![NIST FIPS 203](https://img.shields.io/badge/NIST-FIPS%20203%20%28ML--KEM%29-informational)](#cryptographic-design)
[![Status](https://img.shields.io/badge/status-alpha-orange.svg)](#project-status)

</div>

---

## Overview

SQrypt is a two-part cybersecurity package aimed at helping organizations prepare for the post-quantum transition:

| Component | Purpose |
|---|---|
| **SQrypt SDK** | A client SDK + FastAPI-based Key Management Service (KMS) implementing hybrid classical/post-quantum encryption (X25519 + ML-KEM-768) for protecting data in transit and at rest. |
| **SQrypt CLI Scanner** | A static-analysis engine that scans source code for legacy, quantum-vulnerable cryptography (RSA, ECC/ECDSA, Diffie-Hellman, weak hashes) and generates audit-ready CBOM, JSON, and PDF reports. |

Together, these let a team both **assess** their current cryptographic exposure and **remediate** it by integrating quantum-resistant encryption directly into their applications.

---

## Why SQrypt

Cryptographically Relevant Quantum Computers (CRQCs) threaten to break RSA, ECC, and Diffie-Hellman via Shor's algorithm. Adversaries are already harvesting encrypted traffic today to decrypt once such hardware exists. NIST formalized PQC replacements in **FIPS 203 (ML-KEM)** and **FIPS 204 (ML-DSA)**. SQrypt operationalizes this transition by:

- Surfacing every line of code that still relies on Shor-vulnerable primitives, with file/line-level evidence.
- Scoring and reporting risk in a format suitable for security and compliance review.
- Providing a drop-in hybrid encryption client/server pair so engineering teams can migrate without redesigning their key exchange from scratch.

---

## Architecture

```
┌─────────────────────────┐         ┌──────────────────────────────┐
│        SQrypt SDK        │         │      SQrypt CLI Scanner       │
│  (sqrypt/client.py)      │         │    (sqrypt/cli/scanner.py)    │
│                          │         │                                │
│  SQryptClient            │         │  CodebaseQuantumScanner        │
│   - encrypt()            │         │   - AST-based Python analysis  │
│   - decrypt()            │         │   - Regex-based multi-language │
│   - auto_encrypt()       │         │     analysis (JS/TS/Java/C/    │
│   - protect_dict()       │         │     C++/C#/Go/PHP)             │
└──────────┬───────────────┘         │   - Parallel file scanning     │
           │ HTTPS (X-SQrypt-Key)    │     (ProcessPoolExecutor)      │
           ▼                         │   - Risk scoring engine        │
┌──────────────────────────┐         │   - CBOM / JSON / PDF export   │
│   SQrypt KMS Server       │         └──────────────────────────────┘
│   (kms-server/server.py) │
│   FastAPI + Gunicorn      │
│                            │
│  /v2/public-keys          │
│  /v2/decapsulate          │
│                            │
│  Per-tenant ML-KEM-768 +   │
│  X25519 keypairs           │
└──────────────────────────┘
```

---

## Cryptographic Design

SQrypt's SDK uses a **hybrid key encapsulation** scheme so that confidentiality is preserved even if either the classical or post-quantum primitive is later broken:

1. **Classical layer** — X25519 Elliptic-Curve Diffie-Hellman key exchange.
2. **Post-quantum layer** — ML-KEM-768 (NIST FIPS 203 / "Kyber") key encapsulation.
3. **Key derivation** — Both shared secrets are concatenated and passed through HKDF-SHA256 to derive a single 256-bit symmetric key.
4. **Symmetric encryption** — AES-256-GCM (AEAD) is used to encrypt the payload with the derived key, producing authenticated ciphertext.
5. **Decapsulation** — The KMS server holds the private key material per tenant and exposes a `/v2/decapsulate` endpoint to recover both shared secrets, after which the client re-derives the AES key locally to decrypt.

This means raw private key material never leaves the KMS, and plaintext is only ever reconstructed client-side.

> **Note:** This is a hybrid scheme, not a pure PQC scheme — by design. If ML-KEM-768 were ever found to be weak, X25519 still provides a classical security floor, and vice versa.

---

## Repository Structure

```
SQrypt_Cyber_SDK-main/
├── sqrypt/
│   ├── client.py            # SQryptClient — hybrid encryption SDK
│   └── cli/
│       ├── main.py          # CLI entry point (argparse)
│       ├── scanner.py       # CodebaseQuantumScanner — AST + regex engine
│       └── static/          # Branding assets used in PDF reports
├── kms-server/
│   └── server.py            # FastAPI KMS: key issuance + decapsulation
├── Dockerfile                # Container build for the KMS server
├── docker-compose.yml        # KMS + Redis cache orchestration
├── pyproject.toml            # Package metadata (sqrypt-cyber-sdk)
├── requirements.txt          # KMS server dependencies
└── test_sdk.py                # SDK smoke tests
```

---

## Installation

### SDK + CLI Scanner

```bash
pip install -e .
```

This installs the `sqrypt` package and registers the `sqrypt` console command (via the `[project.scripts]` entry point).

### KMS Server (Docker, recommended for production)

```bash
docker compose up --build
```

This builds the KMS server image and starts it alongside a Redis cache, exposing the API on port `8500`.

---

## Usage

### 1. CLI Scanner — Auditing a Codebase

```bash
# Basic scan with console summary
sqrypt --target /path/to/codebase

# Export a NIST-aligned Cryptographic Bill of Materials
sqrypt --target /path/to/codebase --cbom cbom_report.json

# Export raw findings as JSON
sqrypt --target /path/to/codebase --output-json findings.json

# Generate a branded PDF audit report
sqrypt --target /path/to/codebase --pdf audit_report.pdf
```

| Flag | Description |
|---|---|
| `-t`, `--target` | **(Required)** Path to the codebase to scan. |
| `-j`, `--output-json` | Save raw findings to a JSON file. |
| `-c`, `--cbom` | Export a standardized Cryptographic Bill of Materials. |
| `-p`, `--pdf` | Generate a formatted PDF audit report (optional custom path). |

**Detection coverage:**

| Category | Risk Class | Languages |
|---|---|---|
| RSA | Shor-vulnerable | Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex) |
| ECC / ECDSA | Shor-vulnerable | Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex) |
| Diffie-Hellman | Shor-vulnerable | Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex) |
| Legacy Hashes (MD5, SHA-1, SHA-224) | Deprecated | Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex) |
| PQC Core (Kyber, ML-KEM, Dilithium, ML-DSA, SPHINCS+, SQrypt) | Quantum-resistant | All supported languages |

Python files are parsed with the `ast` module for precise call-site tracking (imports, aliasing, and method invocation). All other supported languages use comment-aware, line-by-line regex matching. Scanning is parallelized across CPU cores via `ProcessPoolExecutor`, with live progress reporting via `tqdm`.

**Risk scoring** is derived from the volume and type of legacy primitives found, ranging from `LOW (Quantum-Resistant Layer Deployed)` through `MEDIUM`, `HIGH`, to `CRITICAL`.

### 2. SDK — Hybrid Encryption in Application Code

```python
from sqrypt.client import SQryptClient

client = SQryptClient(
    server_url="https://your-kms-host:8500",
    api_key="STARTUP_BETA_2026"
)

# Encrypt a value
payload = client.encrypt("sensitive customer data")

# Decrypt it back
plaintext = client.decrypt(payload)
```

**Decorator-based encryption:**

```python
@client.auto_encrypt()
def get_ssn():
    return "123-45-6789"

encrypted_payload = get_ssn()
```

**Protecting specific fields in a dictionary:**

```python
record = {"name": "Jane Doe", "ssn": "123-45-6789", "email": "jane@example.com"}
protected = client.protect_dict(record, sensitive_keys=["ssn", "email"])
```

### 3. KMS Server — Self-Hosting

The KMS server issues per-tenant hybrid keypairs and performs decapsulation on behalf of authenticated clients.

```bash
cd kms-server
uvicorn server:app --host 0.0.0.0 --port 8000
```

| Endpoint | Method | Description |
|---|---|---|
| `/v2/public-keys` | `GET` | Returns the tenant's ML-KEM-768 public key and X25519 public key. |
| `/v2/decapsulate` | `POST` | Accepts a PQC capsule + client X25519 public key, returns both shared secrets. |

Authentication is enforced via the `X-SQrypt-Key` header against a tenant registry.

> **Production note:** The bundled tenant registry (`TENANT_VAULT`) is an in-memory placeholder intended for development and demos. Production deployments should back tenant key material with a secure, encrypted data store (e.g. PostgreSQL or a hardware/cloud KMS) and rotate keys on a defined schedule.

---

## Dependencies

**SDK / CLI** (`pyproject.toml`): `cryptography`, `kyber-py`, `requests`, `fpdf`, `tqdm`, `rich`

**KMS Server** (`requirements.txt`): `fastapi`, `pydantic`, `uvicorn`, `gunicorn`, `kyber-py`, `cryptography`

---

## Project Status

SQrypt is an **early-stage / alpha** project under active development. The current build (`v2.0.0`) is functional for evaluation, internal auditing, and proof-of-concept integrations. Before any production or compliance-critical deployment, teams should:

- Replace the in-memory tenant vault with persistent, encrypted storage.
- Add key rotation, revocation, and audit logging to the KMS.
- Subject the CLI scanner's detection signatures to a false-positive/false-negative review against their specific codebase.
- Conduct an independent security review of the hybrid KEM implementation.

---

## Roadmap

- Expanded language coverage for the CLI scanner (Rust, Ruby, Kotlin, Swift, Scala)
- CI/CD-friendly scan mode with configurable exit-code gating on risk threshold
- Persistent, multi-tenant KMS backend with key rotation and HSM/cloud KMS integration
- ML-DSA (Dilithium) digital signature support alongside the existing ML-KEM encryption layer
- Pluggable, externally configurable detection signature sets

---

## Contributing

Issues and pull requests are welcome. Please open an issue describing the proposed change before submitting larger contributions, and include test coverage for any new detection signatures or SDK behavior.

---

## License

Released under the [MIT License](LICENSE).

Copyright (c) 2026 Aryan Sujay
