sgcp-protocol

State Graph Cryptographic Protocol (SGCP) — Python PyPI package.

Implements draft-sgcp-state-graph-cryptographic-protocol-00 in full.

Install

pip install sgcp

Or from source:

cd sgcp-protocol
pip install -e ".[dev]"

Protocol Stack

SGCP
 ├── X.509 Certificates   (§4)  — identity binding via cryptography library
 ├── ECDH / X25519        (§5.4) — shared secret establishment
 ├── HKDF (SHA-256)       (§8)  — Root Secret → Epoch Key → Packet Key
 ├── SGCP State Graph     (§7)  — nodes + hash chain + authenticated edges
 └── Packet Protection    (§5.8/§5.9) — AES-256-GCM + XOR transform

Quick Start

from sgcp.crypto.ecdh import X25519KeyPair, generate_nonce
from sgcp.crypto.kdf  import (
    derive_root_secret_classic, derive_session_id, compute_context_binding
)
from sgcp.packet.data import create_data_packet, receive_data_packet, DataPacket
from sgcp.constants   import Direction

# --- Phase 4: ECDH ---
client_dh = X25519KeyPair()
server_dh = X25519KeyPair()
dh_secret = client_dh.exchange(server_dh.public_bytes)

# --- Phase 4/8.1: Root Secret ---
cn = generate_nonce(32)   # Client_Nonce
sn = generate_nonce(32)   # Server_Nonce
ch = generate_nonce(32)   # Client_Cert_Hash (SHA-256 of client.crt)
sh = generate_nonce(32)   # Server_Cert_Hash

root_secret = derive_root_secret_classic(dh_secret, cn, sn, ch, sh)

# --- Phase 5: Session_ID ---
session_id = derive_session_id(root_secret, cn, sn)

# --- Phase 6: Context Binding ---
ctx = compute_context_binding(1, "client-device-01", 6, 443, 12345,
                               b"socket-cookie-01", session_id)

# --- Phase 8: Send ---
plaintext = b"Hello from SGCP client!"
pkt = create_data_packet(
    plaintext=plaintext, session_id=session_id, root_secret=root_secret,
    epoch=0, sequence=0,
    direction=Direction.CLIENT_TO_SERVER,
    context_binding=ctx,
)
wire = pkt.to_wire()

# --- Phase 9: Receive ---
from sgcp.packet.data import DataPacket
received = DataPacket.from_wire(wire)
recovered, tag = receive_data_packet(received, session_id, root_secret, ctx)
assert recovered == plaintext
print("Decrypted:", recovered)

MP3 Full-Duplex Transfer Example (§14)

from sgcp.media.transfer import segment_file, reassemble_file

# Sender: segment 7 MB MP3
with open("song.mp3", "rb") as f:
    data = f.read()

segments = list(segment_file(data, segment_size=8192))
# → 896 segments, each protected by a unique per-packet key

# Receiver: reassemble (verifies SHA-256 File_Hash automatically)
reassembled = reassemble_file(segments)
assert reassembled == data

Modules

Run Tests

pip install -e ".[dev]"
pytest tests/ -v

Author

Sripad Karthik sripadkarthik@gmail.com

License

BSD 2-Clause