krypton-core Python bindings

Python bindings for krypton-core, a memory-safe, high-performance Rust library for modern file encryption and secure vaults, built on AES-256-GCM and Argon2id.

The whole Rust API surface is exposed via PyO3:

• single-file .krf containers (encrypt_file / decrypt_file)
• multi-file encrypted Vaults with a documented unlock/lock protocol
• low-level crypto building blocks: Key, seal/open, derive_key, KdfParams, secure_compare, random_nonce
• entry-name sanitization helpers
• a one-to-one mirror of the Rust Error enum as Python exception subclasses

Install (from source)

$ nix develop          # or activate your own cargo + python + maturin
$ maturin develop

Quick start

import krypton

# One file in, one file out. The container is self-contained.
out = krypton.encrypt_file("correct horse", "document.pdf")
name = krypton.decrypt_file("correct horse", out, "restored.pdf")
assert name == "document.pdf"

# Encrypted vault.
vault = krypton.Vault("myvault")
vault.init("correct horse")
vault.unlock("correct horse")
vault.add("secret.pdf")
vault.add("~/photos", name="pictures")     # whole directory tree
for e in vault.list():
    print(f"{e.name} ({e.size} bytes, dir={e.is_directory})")
vault.extract("secret.pdf", "./out")
report = vault.verify("correct horse")
vault.change_password("correct horse", "new horse")
vault.lock()

Low-level API

key = krypton.Key.generate()                       # 32-byte zeroizing key
nonce, ct = krypton.seal(b"plaintext", key, b"aad")
pt = krypton.open(ct, nonce, key, b"aad")

params = krypton.KdfParams(m_cost_kib=65_536, t_cost=4, p_cost=4)
key = krypton.derive_key(b"password", bytes(32), params)

Errors

All errors derive from krypton.KryptonError; each Rust Error variant maps to an eponymous subclass, e.g. KryptonAuthenticationError for wrong passwords or tampered data, KryptonVaultLockedError when operating on a locked vault, and so on.

Development

$ nix develop
$ maturin develop
$ python -m pytest

License

Apache-2.0