red-xai-encrypt (Red-SecretsXAI)

Password-based file, folder and text encryption from Red-XAI LLC, built on a from-scratch C++ core (librsx) with a Python front end. Sealed data can be saved as a compact binary container or as a PNG of red-X "micro-digit" art.

• Argon2id key derivation, ChaCha20-Poly1305 authenticated encryption in 64 KiB chunks, HKDF-SHA256 key separation.
• Two key modes: self-contained password mode, or port mode with a local .red-xai-port keymap folder plus your password.
• Recovery key, Shamir k-of-n key cards, keymap generations with rollback detection.
• Red-X PNG carrier with Reed-Solomon error correction.

Install

pip install red-xai-encrypt

Requires Python 3.10+. Installs numpy and Pillow. Prebuilt native core wheels are published for Linux x86_64 (glibc 2.38+). On other platforms (macOS, Windows, older Linux, aarch64) install from the source distribution and build librsx yourself (CMake + a C++17 compiler; see docs/ inside the sdist):

cmake -S core -B core/build -DCMAKE_BUILD_TYPE=Release -DRSX_SHARED=ON
cmake --build core/build

Then place the built librsx.so / librsx.dylib / librsx.dll in redxai/_native/.

Quickstart

from redxai import encrypt_file, decrypt_file, encrypt_text, decrypt_text

# Self-contained: only the password is needed to open it
out = encrypt_file("notes.txt", "correct horse battery staple", mode="password")
print(out)                                   # notes.txt.Red_SecretXAI (a red-X PNG)
decrypt_file(out, "correct horse battery staple", out_dir="restored")

# Binary container instead of a PNG
encrypt_file("notes.txt", "pw", mode="password", output="binary")

# Text
token = encrypt_text("hello", "pw", mode="password")
assert decrypt_text(token, "pw") == "hello"

A wrong password, or any change to the file, raises WrongPasswordError and nothing is written.

Port mode

Without mode="password", the SDK uses a .red-xai-port folder (keymap) next to your work, created on first use after a setup prompt. You get a 256-bit recovery key once: write it down and store it offline. Losing both the port folder and the recovery key means losing the data.

Command line

redsecretsxai --help                 # or: python -m redsecretsxai --help
redsecretsxai encrypt-file -i report.pdf              # -> report.pdf.Red_SecretXAI
redsecretsxai decrypt-file -i report.pdf.Red_SecretXAI -o report.pdf
redsecretsxai encrypt-folder my-repo -o my-repo.Red_SecretXAI
redsecretsxai archive-preview my-repo.Red_SecretXAI
redsecretsxai decrypt-folder my-repo.Red_SecretXAI -d restored/
redsecretsxai convert my-repo.Red_SecretXAI my-repo.png     # blob <-> red-X PNG
redsecretsxai encode -m "short message" -o msg.png
redsecretsxai decode -i msg.png
redsecretsxai init-port --path ./.red-xai-port

Passwords are prompted without echo when -p is omitted (avoid -p on shared machines; it shows up in shell history and process lists).

File format (overview)

• .Red_SecretXAI files hold an authenticated header (magic, version, capability flags, KDF parameters, salt, nonce) followed by a ChaCha20-Poly1305 stream in 64 KiB chunks. Each chunk has its own tag, counter and final-chunk flag, so tampering, truncation and reordering are detected.
• Folders and drives are packed into an RSXA archive before encryption. Payloads are padded to fixed size bands.
• Output is written to a temporary file and only published after the last chunk verifies; existing files are never overwritten.
• The red-X PNG carrier encodes the encrypted bytes with Reed-Solomon error correction. It must stay a lossless PNG: JPEG, screenshots and resizing will break it.
• Full concept docs (docs/spec/), language guides and test vectors are included in the source distribution.

Security notes and honest limitations

• No independent audit yet. All primitives are implemented from scratch and checked against official test vectors and internal stress testing, but have not been reviewed by an outside firm. Do not rely on it as your only protection for high-value secrets until it has been audited.
• Your password matters. Argon2id makes each guess expensive (default about 0.5 s and 256 MiB), but a weak password can still be guessed.
• The red-X image is a carrier, not extra security. Secrecy comes from the encryption; the image only changes how the data looks and travels.
• Port-mode keymaps are local files. The tripwire and hardware binding are best-effort; sync tools, backups or malware on the same device can still copy files. Keep backups of the recovery key or key cards offline.
• No public-key sharing yet: recipients need the password (or keymap).
• Prebuilt native binaries are provided only for the platforms listed above.

Report security issues privately to support@infected-nation.com.

License

Apache-2.0, copyright 2026 Red-XAI LLC. Red-SecretsXAI, Red-XAI and the red-X logo are trademarks of Red-XAI LLC. Encryption software may be subject to export controls; you are responsible for complying with the laws that apply to you.