dstu-core (Python bindings)

Provisional — not published to PyPI, not independently audited. See the root project's docs/SECURITY.md and docs/DECISIONS.md for the full threat model and per-construction status. This binding wraps the full dstu_core::crypto_* surface (docs/bindings-strategy.md T-49) — install from source as shown below.

Installing (from source)

python -m venv .venv
source .venv/bin/activate        # or .venv\Scripts\activate on Windows
pip install maturin
maturin develop --release
python -c "import dstu_core; dstu_core.selftest()"

pyo3 needs a real Python interpreter to link against at build time. Plain python/python3 may not be enough to find one — on Windows in particular, those names can resolve to non-functional Microsoft Store alias stubs instead of a real install. If cargo build/maturin develop fails to find (or finds the wrong) Python, point it at one explicitly:

export PYO3_PYTHON=/path/to/a/real/python3   # POSIX
$env:PYO3_PYTHON = "C:\path\to\python.exe"   # PowerShell

maturin develop builds the Rust extension and installs it into the active virtualenv as an editable package. dstu_core.selftest() re-runs dstu_core::selftest::run() (docs/TASKS.md T-161) against the exact compiled build and raises RuntimeError if anything official-vector-level is wrong — the first thing to run after any build to confirm it actually works, not just compiled.

This crate is its own Cargo workspace, separate from the repo root (docs/DECISIONS.md D-119) — build/test it from inside this directory, not from the repo root.

Usage

Every function/class below lives directly on the dstu_core module (no submodules). See examples/ for complete, runnable scripts, and tests/ for the full correctness/rejection/misuse suite each one is verified against (D-64/D-65).

import dstu_core as d

key = d.secretbox_keygen()
sealed = d.secretbox_seal(key, b"a message worth protecting")
assert d.secretbox_open(key, sealed) == b"a message worth protecting"
Module Functions/classes Notes
crypto_secretbox secretbox_keygen, secretbox_seal, secretbox_open Single-message authenticated encryption. examples/secretbox.py.
crypto_box box_keygen, box_public_key, box_seal, box_open Public-key encryption (hybrid via KDF over hazmat::dstu9041, l(p)=256, D-169). box_seal/box_open are not memory-bounded — the whole message is held in memory. examples/box.py.
crypto_box512 box512_keygen, box512_public_key, box512_seal, box512_open l(p)=512/E512/1 sibling of crypto_box (T-193/T-204). examples/box512.py.
crypto_secretstream secretstream_keygen, SecretStreamPushState, SecretStreamPullState, SecretStreamEncryptor, SecretStreamDecryptor Chunked streaming AEAD. The file-like SecretStreamEncryptor/SecretStreamDecryptor wire format matches uacrypt encrypt/decrypt exactly (D-118). examples/secretstream_file.py.
crypto_sign sign_keygen, sign_verifying_key, sign_message, sign_verify DSTU 4145 m=163 digital signatures, deterministic nonce (no RNG dependency). examples/sign.py.
crypto_sign257 sign257_keygen, sign257_verifying_key, sign257_message, sign257_verify m=257 sibling of crypto_sign (T-199/T-204) — the curve real Diia-issued qualified signatures use. examples/sign257.py.
crypto_pwhash pwhash_hash_password, pwhash_verify_password, PWHASH_INTERACTIVE/PWHASH_MODERATE/PWHASH_SENSITIVE Argon2id (the one deliberately non-DSTU component, D-49/D-50). examples/password_hashing.py.
crypto_auth auth_keygen, auth, auth_verify Keyed message authentication (Kupyna-KMAC). examples/misc.py.
crypto_kdf kdf_keygen, kdf_derive_subkey Deterministic subkey derivation. examples/misc.py.
crypto_generichash kupyna256, kupyna512, Kupyna256Hasher, Kupyna512Hasher One-shot and streaming Kupyna hashing. examples/misc.py.
crypto_stream stream_keygen, stream_encrypt, stream_decrypt Strumok-256 keystream — unauthenticated, stream_decrypt never fails on tampered input. examples/misc.py.
randombytes randombytes_buf CSPRNG-backed random bytes. examples/misc.py.
— selftest, DstuError Runtime KAT self-check (T-161); the one exception type every crypto-operation failure raises.

Testing

pip install pytest ruff
pytest
ruff check .
ruff format --check .

cargo build -p uacrypt --release (from the repo root) first if you want tests/test_secretstream.py's live uacrypt CLI interop test to actually run instead of skipping. cargo xtask python (from the repo root) runs this whole sequence, including that build step, in one command.

Project links

Data verified by PyPI on Aug 12, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.1)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for user137 from gravatar.com user137

GitHub Statistics

Data verified by PyPI on Aug 12, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT OR Apache-2.0
View SPDX License List

Requires

Python >=3.9

Provides Extra

dev

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

dstu_core-0.1.0-cp39-abi3-win_amd64.whl (321.2 kB view details)

Uploaded CPython 3.9+Windows x86-64

dstu_core-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (485.2 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

dstu_core-0.1.0-cp39-abi3-macosx_11_0_arm64.whl (457.9 kB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

File details

Details for the file dstu_core-0.1.0-cp39-abi3-win_amd64.whl.

File metadata

  • Download URL: dstu_core-0.1.0-cp39-abi3-win_amd64.whl
  • Upload date:
  • Size: 321.2 kB
  • Tags: CPython 3.9+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dstu_core-0.1.0-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 8e7d36114b16c0091ce46ec82e7b02613a6e0db1949a1d38d8074243524fc70f
MD5 4d50b7c89012f156fccb27f146db12b7
BLAKE2b-256 562b2f10faac2780611008e13ad4ddb1248e35466edb95f0bd2a3e993a0d98d7

See more details on using hashes here.

Provenance

The following attestation bundles were made for dstu_core-0.1.0-cp39-abi3-win_amd64.whl:

Publisher: release.yml on user137/uacrypt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dstu_core-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for dstu_core-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 65d6ffdf7d34c9d5dad3c981a5502d67c9afac063e7e4ddb432c4c4e7fb8c859
MD5 5881eb389e4beeb7bfd5a29c0cbaa233
BLAKE2b-256 760b90e83f250124b4242288901c9cfef993d456b2b86c200cb35e939de5f44d

See more details on using hashes here.

Provenance

The following attestation bundles were made for dstu_core-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: release.yml on user137/uacrypt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dstu_core-0.1.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for dstu_core-0.1.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 2a798f59148e6d44b4447f47047fc903e6a945a5fc9c41a4624064df5f913ae1
MD5 241d54899741f281aecd7ecbbf71ed2e
BLAKE2b-256 43719f8b08474690eb9392516cd0321766ebc18fbbbce02410f7ad0a52aad7e4

See more details on using hashes here.

Provenance

The following attestation bundles were made for dstu_core-0.1.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: release.yml on user137/uacrypt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page