GhostBytes

Ghostbytes is a desktop-based user-friendly file encryption and data security utility implmented in python. It features symmetrical, asymmetrical (public / private key), and post-quantum cryptography designs through an intuitive graphical user interface (GUI).

Aim

The goal of this project is to introduce everyday users and beginner developers to the fundamentals of cryptography, data privacy, confidentiality in file sharing.

In today's digital world, privacy isn't just for tech experts. it’s something everyone deserves. This repository aims to break down complex security concepts into simple, practical examples so anyone (even if you just learned your first lines of Python!) can understand how online privacy works and why it matters.

Features

Ghostbytes implemented a range of security features ranging from encryption, key management, hashing, to cryptographical randomness and secure deletion. Core features of the program is listed below:

• 🔒 AES-256 GCM Mode Encryption with Authentication Tag (Integrity and Confidentiality): Encrypt files while providing integrity verification and authenticated encryption.
• 🔒 RSA Asymmetric Encryption / ML-KEM Post-Quantum Cryptography: The Module-Lattice-Based Key-Encapsulation Mechanism is implemented as one of the asymmetric encryption options along with RSA.
• 🔒 Envelope-Based Asymmetric Encryption: Plaintext is encrypted using AES-256-GCM with a symmetric master key, which is then encapsulated and protected using asymmetric encryption to eliminate the message-size limitations of direct asymmetric encryption. (See docs/cryptography.md for more details)
• 🔑 Generate, Verify, and View RSA / ML-KEM / ML-DSA Keys: Encryption keys and post-quantum signature keys can be generated, inspected, and verified within the program.
• ✍️ RSA-PSS and ML-DSA Signatures: Create and verify detached signatures for files using RSA or ML-DSA. ML-DSA-44, ML-DSA-65, and ML-DSA-87 are supported.
• # Fully-Featured Hashing Toolkit: Major hashing algorithms (SHA256, SHA512, SHA3_256, SHA3_512, BLAKE2b, BLAKE2s, and md5) are implemented with an extension feature to copy output to checksum file.
• 🎲 Random Number Generator (with multiple random sources): Ghostbytes also features a function to generate passwords and random data from multiple random sources.
• 🗑️ Secure Delete (File Shredding): Secure delete or file shredding is implemented with multiple overwrite patterns (including random, zero, one, and gutmann)

Supported / Used Algorithms

Requirements

This project uses Uv as the main python package and project manager. In Uv, you can install the project dependencies via the following command:

uv sync

To run code instantly, use this command instead (it automatically triggers a sync before running the code):

uv run ghostbytes

Quick Start / Installation

1. Install uv (either in a virtual environment or globally on your system) (if you haven't already):

pip install uv

2. Clone the repository:

git clone https://github.com/maxttkam/ghostbytes.git

3. Sync the project dependencies:

uv sync

For development, use:

uv sync --group dev

4. Run code directly:

uv run ghostbytes

5. (optional) Install and configure PATH environment variable:

uv tool install
uv tool update-shell

Security Notes

GhostBytes uses established cryptographic primitives, but correct security depends on configuration, key handling, and operational practices.

Important Considerations:

• The encryptor and decryptor must use the same configuration, including the salt, for decryption to succeed.
• Hybrid RSA-OAEP also depends on the matching KDF settings (kdf_salt, time cost, memory cost, and parallelism), because the random AES key seed is derived with Argon2id before it is wrapped with RSA-OAEP.
• Use a preferably unique salt (in advanced settings) for each encryption (if applicable) and keep it with the encrypted data or configuration. Unique salts make precomputed rainbow table attacks more difficult.
• Configuration can be exported to and imported from a .conf file. Use Generate Config (Random Salt) to automatically create a salt from random bytes, then export the configuration so the same settings can be used by the encryptor and decryptor.
• Protect passwords, private keys, and configuration files from unauthorized access.
• Keep backups of important private keys and recovery information.
• Sensitive data, passwords, or keys may be exposed by malware, debugging tools, or memory extraction.
• Use trusted devices and secure environments when handling sensitive information.

Limitations

• RSA key generation above 4096 bits may take significant time due to expensive prime generation operations.
• Python runtime overhead can make CPU-intensive cryptographic operations slower than equivalent lower-level implementations.
• Performance varies depending on hardware and cryptographic backend.

For operations that require speed (if you are a professional and you know what you are doing), consider the following alternatives instead:

VeraCrypt

OpenSSL