Archived
Will Anderson
d1ec384b27
- crates/ → engrams/ (Rust engrams live here) - bindings/ → receptors/ (cross-language access points into the graph) - Cargo.toml workspace paths updated
44 lines
1.6 KiB
Rust
44 lines
1.6 KiB
Rust
/// Engram Crypto — quantum-secure encryption at rest.
|
|
///
|
|
/// # Current Implementation
|
|
///
|
|
/// Uses AES-256-GCM for symmetric encryption with BLAKE3 for key derivation.
|
|
/// AES-256 is already quantum-resistant (Grover's algorithm halves the key space
|
|
/// from 2^256 to 2^128, which remains computationally infeasible).
|
|
///
|
|
/// # Post-Quantum Upgrade Path
|
|
///
|
|
/// The `AlgorithmRegistry` stores an `algorithm_id` alongside every ciphertext.
|
|
/// When ML-KEM (CRYSTALS-Kyber) and ML-DSA (CRYSTALS-Dilithium) crates stabilize,
|
|
/// the upgrade is:
|
|
/// 1. Add `KemAlgorithm::MlKem768` / `MlKem1024` variants
|
|
/// 2. Implement `CryptoEngine::encrypt()` for the new algorithm
|
|
/// 3. Set it as the active algorithm in the registry
|
|
/// 4. Old records continue to decrypt via their stored `algorithm_id`
|
|
/// 5. Background re-encryption rotates old records to the new algorithm
|
|
///
|
|
/// No data migration required — the registry handles version negotiation.
|
|
///
|
|
/// # Usage
|
|
///
|
|
/// ```rust,no_run
|
|
/// use engram_crypto::{CryptoEngine, AlgorithmRegistry};
|
|
///
|
|
/// let key = b"an-example-32-byte-key!!12345678";
|
|
/// let engine = CryptoEngine::from_key(key).unwrap();
|
|
///
|
|
/// let plaintext = b"sensitive memory content";
|
|
/// let encrypted = engine.encrypt(plaintext).unwrap();
|
|
/// let decrypted = engine.decrypt(&encrypted).unwrap();
|
|
/// assert_eq!(plaintext, decrypted.as_slice());
|
|
/// ```
|
|
pub mod algorithm;
|
|
pub mod engine;
|
|
pub mod error;
|
|
pub mod registry;
|
|
|
|
pub use algorithm::{AlgorithmVersion, KemAlgorithm, SigAlgorithm};
|
|
pub use engine::{CryptoEngine, EncryptedContent};
|
|
pub use error::CryptoError;
|
|
pub use registry::AlgorithmRegistry;
|