Metadata-Version: 2.4
Name: red-xai-encrypt
Version: 0.3.0
Summary: Password-based file, folder and text encryption with a from-scratch C++ core and red-X PNG carrier
Author-email: Red-XAI LLC <support@infected-nation.com>
Maintainer-email: Red-XAI LLC <support@infected-nation.com>
License: Apache-2.0
Keywords: encryption,red-xai,security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: C++
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
License-File: NOTICE
Requires-Dist: numpy>=1.24
Requires-Dist: Pillow>=10.0
Dynamic: license-file

# red-xai-encrypt (Red-SecretsXAI)

Password-based file, folder and text encryption from **Red-XAI LLC**, built on a from-scratch C++ core (`librsx`) with a Python front end. Sealed data can be saved as a compact binary container or as a PNG of red-X "micro-digit" art.

- Argon2id key derivation, ChaCha20-Poly1305 authenticated encryption in 64 KiB chunks, HKDF-SHA256 key separation.
- Two key modes: self-contained **password mode**, or **port mode** with a local `.red-xai-port` keymap folder plus your password.
- Recovery key, Shamir k-of-n key cards, keymap generations with rollback detection.
- Red-X PNG carrier with Reed-Solomon error correction.

## Install

```bash
pip install red-xai-encrypt
```

Requires Python 3.10+. Installs `numpy` and `Pillow`. Prebuilt native core wheels are published for **Linux x86_64 (glibc 2.38+)**. On other platforms (macOS, Windows, older Linux, aarch64) install from the source distribution and build `librsx` yourself (CMake + a C++17 compiler; see `docs/` inside the sdist):

```bash
cmake -S core -B core/build -DCMAKE_BUILD_TYPE=Release -DRSX_SHARED=ON
cmake --build core/build
```

Then place the built `librsx.so` / `librsx.dylib` / `librsx.dll` in `redxai/_native/`.

## Quickstart

```python
from redxai import encrypt_file, decrypt_file, encrypt_text, decrypt_text

# Self-contained: only the password is needed to open it
out = encrypt_file("notes.txt", "correct horse battery staple", mode="password")
print(out)                                   # notes.txt.Red_SecretXAI (a red-X PNG)
decrypt_file(out, "correct horse battery staple", out_dir="restored")

# Binary container instead of a PNG
encrypt_file("notes.txt", "pw", mode="password", output="binary")

# Text
token = encrypt_text("hello", "pw", mode="password")
assert decrypt_text(token, "pw") == "hello"
```

A wrong password, or any change to the file, raises `WrongPasswordError` and nothing is written.

### Port mode

Without `mode="password"`, the SDK uses a `.red-xai-port` folder (keymap) next to your work, created on first use after a setup prompt. You get a **256-bit recovery key once**: write it down and store it offline. Losing both the port folder and the recovery key means losing the data.

## Command line

```bash
redsecretsxai --help                 # or: python -m redsecretsxai --help
redsecretsxai encrypt-file -i report.pdf              # -> report.pdf.Red_SecretXAI
redsecretsxai decrypt-file -i report.pdf.Red_SecretXAI -o report.pdf
redsecretsxai encrypt-folder my-repo -o my-repo.Red_SecretXAI
redsecretsxai archive-preview my-repo.Red_SecretXAI
redsecretsxai decrypt-folder my-repo.Red_SecretXAI -d restored/
redsecretsxai convert my-repo.Red_SecretXAI my-repo.png     # blob <-> red-X PNG
redsecretsxai encode -m "short message" -o msg.png
redsecretsxai decode -i msg.png
redsecretsxai init-port --path ./.red-xai-port
```

Passwords are prompted without echo when `-p` is omitted (avoid `-p` on shared machines; it shows up in shell history and process lists).

## File format (overview)

- `.Red_SecretXAI` files hold an authenticated header (magic, version, capability flags, KDF parameters, salt, nonce) followed by a ChaCha20-Poly1305 stream in 64 KiB chunks. Each chunk has its own tag, counter and final-chunk flag, so tampering, truncation and reordering are detected.
- Folders and drives are packed into an RSXA archive before encryption. Payloads are padded to fixed size bands.
- Output is written to a temporary file and only published after the last chunk verifies; existing files are never overwritten.
- The red-X PNG carrier encodes the encrypted bytes with Reed-Solomon error correction. It must stay a lossless PNG: JPEG, screenshots and resizing will break it.
- Full concept docs (`docs/spec/`), language guides and test vectors are included in the source distribution.

## Security notes and honest limitations

- **No independent audit yet.** All primitives are implemented from scratch and checked against official test vectors and internal stress testing, but have not been reviewed by an outside firm. Do not rely on it as your only protection for high-value secrets until it has been audited.
- **Your password matters.** Argon2id makes each guess expensive (default about 0.5 s and 256 MiB), but a weak password can still be guessed.
- **The red-X image is a carrier, not extra security.** Secrecy comes from the encryption; the image only changes how the data looks and travels.
- **Port-mode keymaps are local files.** The tripwire and hardware binding are best-effort; sync tools, backups or malware on the same device can still copy files. Keep backups of the recovery key or key cards offline.
- **No public-key sharing** yet: recipients need the password (or keymap).
- Prebuilt native binaries are provided only for the platforms listed above.

Report security issues privately to **support@infected-nation.com**.

## License

Apache-2.0, copyright 2026 Red-XAI LLC. Red-SecretsXAI, Red-XAI and the red-X logo are trademarks of Red-XAI LLC. Encryption software may be subject to export controls; you are responsible for complying with the laws that apply to you.
