SecureVault - Post-Quantum File Encryption

Protect your files from future quantum computers.

SecureVault is a cross-platform post-quantum encryption tool that protects files using NIST-standardized ML-KEM-768 or ML-KEM-1024 combined with classical X25519 hybrid encryption.

The Problem

Quantum computers are not there yet, but large fault-tolerant quantum computers could eventually threaten things like RSA and ECC. Attackers can still collect encrypted data NOW and try to decrypt it LATER if better attacks or stronger computers become available.

This is called a "harvest now, decrypt later" attack.

The Solution

SecureVault uses:

ML-KEM-768 or ML-KEM-1024 (NIST standardized post-quantum KEMs)

X25519 (classical elliptic-curve)

Hybrid encryption (both together)

I like to call this defense in depth² 😭 but quick nerd note: in v0.4.0 the same file key is wrapped through both paths, so this is not a formal guarantee that someone must break BOTH algorithms to recover the file key. SecureVault is still experimental and has not been independently audited.

Features

Hybrid encryption: X25519 + ML-KEM-768 or ML-KEM-1024 (defense in depth²)

Authenticated file encryption using Fernet (AES-CBC + HMAC)

Password-protected keys: PBKDF2 key derivation (100k iterations)

Cross-platform: Works on Linux, macOS, and Windows

Post-quantum ready: Uses NIST-standardized algorithms designed to resist known quantum attacks

Digital signatures: Ed25519 + ML-DSA-65

Easy CLI + Desktop GUI: Simple commands, no crypto knowledge needed; very easy to navigate

No installation required for GUI: Download and run - works out of the box

Educational: Shows security info about your files

Designed for long-term security

Choose Your Version

Version

Best For

Installation

Desktop GUI

Most users, drag-and-drop simplicity

Download

CLI

Developers, automation, scripting

pip install securevault-pqc

Note: GUI executables are currently version 0.3.0. The CLI release documented here is version 0.4.0.

Installation

Option 1: Desktop GUI (Recommended for most users)

Download the standalone application for your platform:

🔗 Download SecureVault GUI

Available for:

Windows (.exe)

macOS (.app)

Linux (executable)

Security verification: Before running the downloaded file, verify its integrity using the checksums provided on the download page. This ensures your download wasn't modified or intercepted.

macOS/Linux

shasum -a 256 SecureVault-macos

Windows (PowerShell)

Get-FileHash SecureVault-windows.exe -Algorithm SHA256

Compare the output with the checksum at: https://meganealexis.net/securevault/

No installation required - just download, verify, and run!

Option 2: Command-Line Interface (CLI)

For developers, automation, or advanced users who prefer the terminal.

Prerequisites

Python 3.9 or higher

pip

Platform-Specific Setup

liboqs / liboqs-python Compatibility

SecureVault 0.4.0 currently targets:

liboqs-python >= 0.16.0 and < 0.17

In most cases, you do NOT need to build liboqs manually. If installation succeeds with pip, you can skip manual setup.

macOS Setup

Manual build instructions below are for advanced users. The liboqs version shown may differ from the liboqs-python wheel and can be adjusted if needed.

1. Install CMake (if not already installed)

brew install cmake

2. Build liboqs with shared library support

cd /tmp git clone --branch 0.16.0 https://github.com/open-quantum-safe/liboqs.git cd liboqs mkdir build && cd build cmake -DBUILD_SHARED_LIBS=ON -DCMAKE_INSTALL_PREFIX=/opt/homebrew/opt/liboqs .. make -j$(sysctl -n hw.ncpu) sudo make install

3. Create symlinks where liboqs-python expects the library

mkdir -p ~/.oqs/lib ~/.oqs/lib64 ln -sf /opt/homebrew/opt/liboqs/lib/liboqs.dylib ~/.oqs/lib/liboqs.dylib ln -sf /opt/homebrew/opt/liboqs/lib/liboqs.dylib ~/.oqs/lib64/liboqs.dylib

4. Create and activate virtual environment

cd ~/Documents/Testing_securevault python3 -m venv venv source venv/bin/activate

5. Install SecureVault

pip install securevault-pqc

6. Test it!

securevault --help

Windows Setup

Manual build instructions below are for advanced users. The liboqs version shown may differ from the liboqs-python wheel and can be adjusted if needed.

1. Install Chocolatey build tools (if not already installed)

choco install visualstudio2022buildtools visualstudio2022-workload-vctools -y

2. Build liboqs

cd $env:TEMP git clone --branch 0.16.0 https://github.com/open-quantum-safe/liboqs.git cd liboqs mkdir build cd build

cmake -DBUILD_SHARED_LIBS=ON -DCMAKE_INSTALL_PREFIX="$env:USERPROFILE\_oqs" -G "Visual Studio 17 2022" -A x64 ..

cmake --build . --config Release cmake --install . --config Release

3. Verify DLL was created

ls "$env:USERPROFILE_oqs\bin\oqs.dll"

4. Create and activate virtual environment

cd ~/Documents/Testing_securevault python -m venv venv .\venv\Scripts\Activate.ps1

5. Install SecureVault

pip install securevault-pqc

6. Test it!

securevault --help

Linux Setup

1. Install dependencies (Ubuntu/Debian)

sudo apt-get update sudo apt-get install cmake build-essential

2. Create and activate virtual environment

cd ~/Documents/Testing_securevault python3 -m venv venv source venv/bin/activate

3. Install SecureVault

pip install securevault-pqc

4. Test it!

securevault --help

Quick Start

Basic Workflow

Alice generates keys → Shares alice_public.key with Bob Bob encrypts file.txt using alice_public.key + bob.key → Sends file.txt.vault to Alice Alice decrypts file.txt.vault using alice.key + bob_public.key

CLI Example

1. Generate your keypair

securevault keygen --output my_keys.key

You'll be asked to enter a password - remember it, you'll need it for encrypting/decrypting

Creates: my_keys.key (private) and my_keys_public.key (public)

2. Share your public key

Send my_keys_public.key to anyone who wants to send you encrypted files

Get their public key (e.g., alice_public.key) for sending files to them

3. Create a test file

echo "Secret data" > secret.txt

4. Encrypt a file (sending to Alice)

securevault encrypt secret.txt alice_public.key my_keys.key

You'll be asked to enter your password

Output: secret.txt.vault

5. Check security info

securevault info secret.txt.vault

6. Decrypt a file (Alice received your file)

securevault decrypt secret.txt.vault alice.key my_keys_public.key

Alice enters her password

Output: secret.txt

New in v0.4.0

A few examples for the new CLI features we added:

Generate a keypair with ML-KEM-1024

securevault keygen --output alice.key --kem ML-KEM-1024

ML-KEM-768 is still the default

securevault keygen --output bob.key --kem ML-KEM-768

The recipient's public key decides which KEM the vault uses

If alice_public.key was generated with ML-KEM-1024,

this vault will use ML-KEM-1024 automatically

securevault encrypt secret.txt alice_public.key bob.key --output secret_1024.vault

Check which KEM a vault is using

securevault info secret_1024.vault

Refuse to overwrite existing key files by default

securevault keygen --output alice.key

If you REALLY want to overwrite them lol

securevault keygen --output alice.key --kem ML-KEM-1024 --force

Decrypt straight to stdout instead of writing plaintext to disk

securevault decrypt secret_1024.vault alice.key bob_public.key --output -

Example: pipe decrypted text into another command

securevault decrypt notes.vault alice.key bob_public.key --output - | grep api_key

Small reminder: --output - sends the decrypted plaintext to stdout, while SecureVault status messages stay on stderr so they do not get mixed into your plaintext.

Real Example with Names

If your private key is bob.key and you're sending to Alice (alice_public.key):

securevault encrypt document.pdf alice_public.key bob.key

If your private key is alice.key and you're receiving from Bob (bob_public.key):

securevault decrypt document.pdf.vault alice.key bob_public.key

Common Mistakes

Using a private key when a public key is expected.

Mixing keys generated by different tool versions.

Using the wrong password when decrypting private keys.

Modifying a .vault file manually — tampering will cause signature verification to fail.

GUI Usage

The desktop GUI provides the same functionality with a visual interface:

Generate Keys - Create your keypair with password protection

Encrypt Files - Drag and drop files, select recipient's public key

Decrypt Files - Select .vault file and provide your private key

View Info - Check encryption details and security information

No command-line knowledge needed!

Running the Desktop GUI

Windows

Download SecureVault-v0.3.0-Windows.exe

Double-click the executable to launch SecureVault

Security Warning: Windows may show a SmartScreen warning because this is a new, unsigned application

Click "More info"

Click "Run anyway"

This is expected for early releases and does not indicate malicious software

macOS

Download SecureVault-v0.3.0-macOS.app.zip

Unzip the downloaded file

Open Terminal and navigate to your Downloads folder:

cd ~/Downloads

Make the application executable:

chmod +x SecureVault-v0.3.0-macOS.app/Contents/MacOS/SecureVault

Run the application:

./SecureVault-v0.3.0-macOS.app/Contents/MacOS/SecureVault

Security Warning: macOS may block the application on first run

Go to System Settings → Privacy & Security

Scroll down to find "SecureVault was blocked"

Click "Open Anyway"

Run the application again

Alternative (if the app bundle doesn't work): You can also double-click the unzipped .app file in Finder, then follow step 6 above if blocked.

Linux

Download SecureVault-v0.3.0-Linux

Open Terminal and navigate to your Downloads folder:

cd ~/Downloads

Make the file executable:

chmod +x SecureVault-v0.3.0-Linux

Run the application:

./SecureVault-v0.3.0-Linux

Verifying Your Download (Recommended)

Before running the application, verify the download integrity using SHA-256 checksums:

Windows (PowerShell):

cd $HOME\Downloads Get-FileHash .\SecureVault-v0.3.0-Windows.exe -Algorithm SHA256

macOS:

cd ~/Downloads shasum -a 256 SecureVault-v0.3.0-macOS.app.zip

Linux:

cd ~/Downloads sha256sum SecureVault-v0.3.0-Linux

Compare the output hash with the checksums published at: https://meganealexis.net/securevault/downloads/checksums.txt

If the hashes match exactly, your download is verified and safe to run.

Technical Details

SecureVault uses a hybrid post-quantum + classical design:

Key exchange:

ML-KEM-768 or ML-KEM-1024 (post-quantum, NIST standardized)

X25519 (classical elliptic-curve key exchange)

File encryption:

Fernet (AES-CBC + HMAC authentication)

Key wrapping:

AES-256-GCM used to protect the generated file encryption key

Key derivation:

PBKDF2 (100k iterations)

Signatures:

Ed25519 (classical)

ML-DSA-65 (post-quantum)

This design provides defense-in-depth by combining classical and post-quantum primitives.

Security Model

SecureVault is designed to protect files against both classical and future quantum-capable attackers.

What SecureVault Protects Against

Passive interception of encrypted files ("harvest now, decrypt later" attacks)

Tampering or modification of .vault files

Forged sender identity through dual-signature verification

Offline attacks against stored private keys through password-based encryption

Security Guarantees

Files are encrypted with a randomly generated symmetric key.

The symmetric key is wrapped using both:

ML-KEM-768 (post-quantum)

X25519 (classical)

Vault integrity is protected with two signatures:

Ed25519

ML-DSA-65

Signature verification is fail-closed; modified or corrupted vaults will not decrypt.

One Important Design Note

SecureVault 0.4.0 wraps the same randomly generated file key through both the X25519 path and the ML-KEM path, then checks that both unwrap to the same key before decrypting.

That is useful for validation inside SecureVault, but I do NOT want to pretend this means an attacker is forced to break both algorithms. If one wrapping path were completely broken, an attacker could potentially recover the file key from that side directly.

So yes, the hybrid design is intentional, but it is still experimental. A future vault format can improve this by deriving one wrapping key from both shared secrets instead of storing two independently wrapped copies of the same file key.

Out of Scope / Not Protected

SecureVault does NOT protect against:

Malware or keyloggers running on your machine

Weak user passwords

Compromised operating systems

Loss of private keys or passwords

Side-channel attacks

Threat Model Summary

SecureVault assumes:

The attacker can fully access encrypted .vault files.

The attacker may have future quantum capabilities.

The attacker does NOT control your local machine during encryption/decryption.

Security note: SecureVault is intended for educational and practical experimentation. Independent security review is recommended before relying on it for high-value or regulated data.

Security Notice

⚠️ SecureVault has not yet been independently audited.

This is an educational and experimental cryptography project. While it uses NIST-standardized algorithms (ML-KEM-768, ML-DSA-65) and follows best practices, it should not be used for critical security applications without a professional security audit.

Project Status

Active development.

Educational + experimental cryptography project.

Changelog

0.4.0

Added ML-KEM-1024 support alongside ML-KEM-768

Added --kem when generating keys

The recipient's key now decides which ML-KEM level the vault uses

Added vault format v2 with explicit kem_algorithm

Kept backward compatibility with genuine v1 vaults and old key files

v1 vaults automatically fall back to ML-KEM-768

Added .key filename normalization

Added overwrite protection so key files are not replaced by accident

Added --force if you REALLY do want to overwrite them lol

Cleaned up wrong-password and KEM-mismatch errors so they do not dump ugly Python tracebacks

Added --output - so decrypted plaintext can go straight to stdout instead of touching disk

Kept status messages on stderr so stdout stays clean

Added UTF-8 CLI output handling for Windows when output is redirected

Updated securevault info to show the KEM being used and explain the v1 fallback

Expanded testing for ML-KEM-768/1024, tampering, fail-closed behavior, stdout separation, wrong passwords, KEM mismatch, and genuine v1 backward compatibility

0.3.0.post1

Fixed README documentation error

0.3.0

SECURITY FIXES

Fixed ML-DSA-65 signature verification (was completely broken in 0.2.1.post1)

Switched from dilithium_py to liboqs for correct signature implementation

Implemented fail-closed verification (decryption now blocks if signatures fail)

Added envelope signing (signs entire vault metadata, prevents tampering)

format_version field for forward/backward compatibility

tool_version field showing SecureVault version

Proper signature algorithm identifier: "Ed25519+ML-DSA-65 (oqs)"

Version checking in decrypt to prevent format incompatibilities

0.2.1.post1

Improved CLI command structure for better readability and discoverability

Clarified --help output and usage examples

Minor documentation and UX improvements

0.2.1

Added securevault --version

Improved CLI help clarity

Suppressed non-fatal liboqs version warnings for clean CLI output

Minor UX polish

0.2.0.post3

Packaging and metadata fixes

README updates and clarifications

0.2.0

Hybrid post-quantum + classical encryption (ML-KEM-768 + X25519)

File signing and verification

GUI test interface added

0.1.0

Initial prototype release

Basic key generation, encryption, and decryption

License

MIT License

Copyright (c) 2026 Mégane Alexis

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Source Code Availability

SecureVault executables are currently available for download under the MIT License.

The SecureVault CLI source code is distributed via PyPI.

Additional components (GUI and advanced tooling) may be released separately as development progresses.

Bug Reports / Contact

GitHub issues are currently disabled.

If you find bugs or security concerns, contact:

📧 meganealexis12@gmail.com

🔗 LinkedIn: https://www.linkedin.com/in/megane-alexis/

Author

Mégane Alexis Recent Grad in Computer Science · Cybersecurity · Cryptography