dstu-core (Python bindings)

Not independently audited. See the root project's docs/SECURITY.md and docs/DECISIONS.md for the full threat model and per-construction status. This binding wraps the full dstu_core::crypto_* surface (docs/bindings-strategy.md T-49).

Installing

pip install dstu-core
python -c "import dstu_core; dstu_core.selftest()"

Building from source (contributors)

python -m venv .venv
source .venv/bin/activate        # or .venv\Scripts\activate on Windows
pip install maturin
maturin develop --release
python -c "import dstu_core; dstu_core.selftest()"

pyo3 needs a real Python interpreter to link against at build time. Plain python/python3 may not be enough to find one — on Windows in particular, those names can resolve to non-functional Microsoft Store alias stubs instead of a real install. If cargo build/maturin develop fails to find (or finds the wrong) Python, point it at one explicitly:

export PYO3_PYTHON=/path/to/a/real/python3   # POSIX
$env:PYO3_PYTHON = "C:\path\to\python.exe"   # PowerShell

maturin develop builds the Rust extension and installs it into the active virtualenv as an editable package. dstu_core.selftest() re-runs dstu_core::selftest::run() (docs/TASKS.md T-161) against the exact compiled build and raises RuntimeError if anything official-vector-level is wrong — the first thing to run after any build to confirm it actually works, not just compiled.

This crate is its own Cargo workspace, separate from the repo root (docs/DECISIONS.md D-119) — build/test it from inside this directory, not from the repo root.

Usage

Every function/class below lives directly on the dstu_core module (no submodules). See examples/ for complete, runnable scripts, and tests/ for the full correctness/rejection/misuse suite each one is verified against (D-64/D-65).

import dstu_core as d

key = d.secretbox_keygen()
sealed = d.secretbox_seal(key, b"a message worth protecting")
assert d.secretbox_open(key, sealed) == b"a message worth protecting"
Module Functions/classes Notes
crypto_secretbox secretbox_keygen, secretbox_seal, secretbox_open Single-message authenticated encryption. examples/secretbox.py.
crypto_box box_keygen, box_public_key, box_seal, box_open Public-key encryption (hybrid via KDF over hazmat::dstu9041, l(p)=256, D-169). box_seal/box_open are not memory-bounded — the whole message is held in memory. examples/box.py.
crypto_box512 box512_keygen, box512_public_key, box512_seal, box512_open l(p)=512/E512/1 sibling of crypto_box (T-193/T-204). examples/box512.py.
crypto_secretstream secretstream_keygen, SecretStreamPushState, SecretStreamPullState, SecretStreamEncryptor, SecretStreamDecryptor Chunked streaming AEAD. The file-like SecretStreamEncryptor/SecretStreamDecryptor wire format matches uacrypt encrypt/decrypt exactly (D-118). examples/secretstream_file.py.
crypto_sign sign_keygen, sign_verifying_key, sign_message, sign_verify DSTU 4145 m=163 digital signatures, deterministic nonce (no RNG dependency). examples/sign.py.
crypto_sign257 sign257_keygen, sign257_verifying_key, sign257_message, sign257_verify m=257 sibling of crypto_sign (T-199/T-204) — the curve real Diia-issued qualified signatures use. examples/sign257.py.
crypto_pwhash pwhash_hash_password, pwhash_verify_password, PWHASH_INTERACTIVE/PWHASH_MODERATE/PWHASH_SENSITIVE Argon2id (the one deliberately non-DSTU component, D-49/D-50). examples/password_hashing.py.
crypto_auth auth_keygen, auth, auth_verify Keyed message authentication (Kupyna-KMAC). examples/misc.py.
crypto_kdf kdf_keygen, kdf_derive_subkey Deterministic subkey derivation. examples/misc.py.
crypto_generichash kupyna256, kupyna512, Kupyna256Hasher, Kupyna512Hasher One-shot and streaming Kupyna hashing. examples/misc.py.
crypto_stream stream_keygen, stream_encrypt, stream_decrypt Strumok-256 keystream — unauthenticated, stream_decrypt never fails on tampered input. examples/misc.py.
randombytes randombytes_buf CSPRNG-backed random bytes. examples/misc.py.
— selftest, DstuError Runtime KAT self-check (T-161); the one exception type every crypto-operation failure raises.

Testing

pip install pytest ruff
pytest
ruff check .
ruff format --check .

cargo build -p uacrypt --release (from the repo root) first if you want tests/test_secretstream.py's live uacrypt CLI interop test to actually run instead of skipping. cargo xtask python (from the repo root) runs this whole sequence, including that build step, in one command.

Project links

Data verified by PyPI on Aug 13, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for user137 from gravatar.com user137

GitHub Statistics

Data verified by PyPI on Aug 13, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT OR Apache-2.0
View SPDX License List

Requires

Python >=3.9

Provides Extra

dev

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

dstu_core-0.1.1-cp39-abi3-win_amd64.whl (321.5 kB view details)

Uploaded CPython 3.9+Windows x86-64

dstu_core-0.1.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (484.8 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

dstu_core-0.1.1-cp39-abi3-macosx_11_0_arm64.whl (457.6 kB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

File details

Details for the file dstu_core-0.1.1-cp39-abi3-win_amd64.whl.

File metadata

  • Download URL: dstu_core-0.1.1-cp39-abi3-win_amd64.whl
  • Upload date:
  • Size: 321.5 kB
  • Tags: CPython 3.9+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dstu_core-0.1.1-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 f728d4df8cfa26d7aa866933c30b391f28b0aee93d1f4ee3e82dbd6f8a6dafc4
MD5 1f3098f6a99bfbb11cd8db4efe5690bc
BLAKE2b-256 c3ba5609479bd0b0e5a2548a8f1c4de8c6b4455f5dbc5a8e69c92b19a77ed9bd

See more details on using hashes here.

Provenance

The following attestation bundles were made for dstu_core-0.1.1-cp39-abi3-win_amd64.whl:

Publisher: release.yml on user137/uacrypt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dstu_core-0.1.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for dstu_core-0.1.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 e579c5e6eae4c8ed9ee4dc78a1a9e9c73ab7f364d0202726b23481a9247cb841
MD5 e0dd0b610b56530a837c540df4149bef
BLAKE2b-256 e0b99053e4818862acbadf3506d4eec41a79759a127189795e353e4e4c030743

See more details on using hashes here.

Provenance

The following attestation bundles were made for dstu_core-0.1.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: release.yml on user137/uacrypt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dstu_core-0.1.1-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for dstu_core-0.1.1-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 5cba6bfebf49bd40082d627c6e95042cf15e24623dc9c4b98e3a8d57f25207d4
MD5 b2eb0305f609f6280c2772ce38d4de8f
BLAKE2b-256 9ba994f2b69b0d5319d6152d5b0ef38e18563675c727b28aeac08c622fe7fe89

See more details on using hashes here.

Provenance

The following attestation bundles were made for dstu_core-0.1.1-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: release.yml on user137/uacrypt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page