our-crypto

Cryptographic abstractions for proxy re-encryption, MLS group messaging, and zero-knowledge proofs in the ourochronos ecosystem.

Overview

our-crypto provides abstract interfaces with both mock and real implementations for three cryptographic primitives used across the ourochronos stack:

• Proxy Re-Encryption (PRE) — Allows a proxy to transform ciphertext from one key to another without decrypting it. Used for secure federation aggregation where a relay can re-encrypt shared beliefs without seeing the plaintext.
• MLS (Messaging Layer Security) — Group key agreement per RFC 9420 with forward secrecy, post-compromise security, and epoch-based key ratcheting. Powers encrypted group communication.
• Zero-Knowledge Proofs (ZKP) — Proves compliance properties (consent, policy adherence, domain membership) without revealing underlying data.

Backend Status

Install

pip install our-crypto

Runtime dependency: cryptography>=42.0 (PyCA, audited).

Optional for BLS12-381 Pedersen commitments in ZKP:

pip install our-crypto[zkp]

Usage

Factory Functions

from our_crypto import create_pre_backend, create_mls_backend, create_zkp_backend

# Mock backends (for testing)
pre = create_pre_backend("mock")
mls = create_mls_backend("mock")
zkp = create_zkp_backend("mock")

# Real backends (for production)
pre = create_pre_backend("x25519")
mls = create_mls_backend("hkdf")
zkp = create_zkp_backend("sigma")

Proxy Re-Encryption

from our_crypto import create_pre_backend

backend = create_pre_backend("x25519")

# Generate keypairs
alice = backend.generate_keypair(b"alice")
bob = backend.generate_keypair(b"bob")

# Encrypt for Alice
ciphertext = backend.encrypt(b"shared belief data", alice.public_key)

# Generate re-encryption key (Alice -> Bob)
rekey = backend.generate_rekey(alice.private_key, bob.public_key)

# Re-encrypt without decrypting (proxy operation)
re_encrypted = backend.re_encrypt(ciphertext, rekey)

# Bob decrypts
plaintext = backend.decrypt(re_encrypted, bob.private_key)

MLS Group Messaging

from our_crypto import create_mls_backend

backend = create_mls_backend("hkdf")

# Create a group
group = backend.create_group(b"group-123", creator_id=b"alice")

# Add members (epoch advances, key schedule ratchets)
group = backend.add_member(group.group_id, b"bob", b"bob-key-package")

# Get current key schedule (HKDF-derived)
key_schedule = backend.get_key_schedule(group.group_id)

Zero-Knowledge Proofs

from our_crypto import create_zkp_backend, ComplianceProofType

backend = create_zkp_backend("sigma")
backend.setup(ComplianceProofType.HAS_CONSENT)

# Prove consent without revealing the record
prover = backend.create_prover(ComplianceProofType.HAS_CONSENT)
proof = prover.prove(
    private_inputs={"consent_record": b"..."},
    public_inputs={"user_id": "alice", "action": "read"},
)

# Verify independently
verifier = backend.create_verifier(ComplianceProofType.HAS_CONSENT)
result = verifier.verify(proof, {"user_id": "alice", "action": "read"})
assert result.valid

API

PRE

MLS

ZKP

Factory Functions

Development

# Install with dev dependencies
make dev

# Run linters
make lint

# Run tests
make test

# Run tests with coverage
make test-cov

# Auto-format
make format

State Ownership

None. This package is stateless — it provides interfaces and implementations only. Real backends maintain in-memory state for their operation (DEK cache for PRE, group state for MLS, parameters for ZKP) but persist nothing.

Part of Valence

This brick is part of the Valence knowledge substrate. See our-infra for ourochronos conventions.

License

MIT