sqrypt-cyber-sdk 2.0.0

Enterprise Post-Quantum Cybersecurity SDK and CBOM Auditing Suite

SQrypt

Post-Quantum Cryptographic Security Suite

Hybrid encryption SDK + Cryptographic Bill of Materials (CBOM) auditing engine, built for the "Harvest Now, Decrypt Later" threat era

---

Overview

SQrypt is a two-part cybersecurity package aimed at helping organizations prepare for the post-quantum transition:

Component	Purpose
SQrypt SDK	A client SDK + FastAPI-based Key Management Service (KMS) implementing hybrid classical/post-quantum encryption (X25519 + ML-KEM-768) for protecting data in transit and at rest.
SQrypt CLI Scanner	A static-analysis engine that scans source code for legacy, quantum-vulnerable cryptography (RSA, ECC/ECDSA, Diffie-Hellman, weak hashes) and generates audit-ready CBOM, JSON, and PDF reports.

Together, these let a team both assess their current cryptographic exposure and remediate it by integrating quantum-resistant encryption directly into their applications.

---

Why SQrypt

Cryptographically Relevant Quantum Computers (CRQCs) threaten to break RSA, ECC, and Diffie-Hellman via Shor's algorithm. Adversaries are already harvesting encrypted traffic today to decrypt once such hardware exists. NIST formalized PQC replacements in FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA). SQrypt operationalizes this transition by:

• Surfacing every line of code that still relies on Shor-vulnerable primitives, with file/line-level evidence.
• Scoring and reporting risk in a format suitable for security and compliance review.
• Providing a drop-in hybrid encryption client/server pair so engineering teams can migrate without redesigning their key exchange from scratch.

---

Architecture

┌─────────────────────────┐         ┌──────────────────────────────┐
│        SQrypt SDK        │         │      SQrypt CLI Scanner       │
│  (sqrypt/client.py)      │         │    (sqrypt/cli/scanner.py)    │
│                          │         │                                │
│  SQryptClient            │         │  CodebaseQuantumScanner        │
│   - encrypt()            │         │   - AST-based Python analysis  │
│   - decrypt()            │         │   - Regex-based multi-language │
│   - auto_encrypt()       │         │     analysis (JS/TS/Java/C/    │
│   - protect_dict()       │         │     C++/C#/Go/PHP)             │
└──────────┬───────────────┘         │   - Parallel file scanning     │
           │ HTTPS (X-SQrypt-Key)    │     (ProcessPoolExecutor)      │
           ▼                         │   - Risk scoring engine        │
┌──────────────────────────┐         │   - CBOM / JSON / PDF export   │
│   SQrypt KMS Server       │         └──────────────────────────────┘
│   (kms-server/server.py) │
│   FastAPI + Gunicorn      │
│                            │
│  /v2/public-keys          │
│  /v2/decapsulate          │
│                            │
│  Per-tenant ML-KEM-768 +   │
│  X25519 keypairs           │
└──────────────────────────┘

---

Cryptographic Design

SQrypt's SDK uses a hybrid key encapsulation scheme so that confidentiality is preserved even if either the classical or post-quantum primitive is later broken:

1. Classical layer — X25519 Elliptic-Curve Diffie-Hellman key exchange.
2. Post-quantum layer — ML-KEM-768 (NIST FIPS 203 / "Kyber") key encapsulation.
3. Key derivation — Both shared secrets are concatenated and passed through HKDF-SHA256 to derive a single 256-bit symmetric key.
4. Symmetric encryption — AES-256-GCM (AEAD) is used to encrypt the payload with the derived key, producing authenticated ciphertext.
5. Decapsulation — The KMS server holds the private key material per tenant and exposes a /v2/decapsulate endpoint to recover both shared secrets, after which the client re-derives the AES key locally to decrypt.

This means raw private key material never leaves the KMS, and plaintext is only ever reconstructed client-side.

Note: This is a hybrid scheme, not a pure PQC scheme — by design. If ML-KEM-768 were ever found to be weak, X25519 still provides a classical security floor, and vice versa.

---

Repository Structure

SQrypt_Cyber_SDK-main/
├── sqrypt/
│   ├── client.py            # SQryptClient — hybrid encryption SDK
│   └── cli/
│       ├── main.py          # CLI entry point (argparse)
│       ├── scanner.py       # CodebaseQuantumScanner — AST + regex engine
│       └── static/          # Branding assets used in PDF reports
├── kms-server/
│   └── server.py            # FastAPI KMS: key issuance + decapsulation
├── Dockerfile                # Container build for the KMS server
├── docker-compose.yml        # KMS + Redis cache orchestration
├── pyproject.toml            # Package metadata (sqrypt-cyber-sdk)
├── requirements.txt          # KMS server dependencies
└── test_sdk.py                # SDK smoke tests

---

Installation

SDK + CLI Scanner

pip install -e .

This installs the sqrypt package and registers the sqrypt console command (via the [project.scripts] entry point).

KMS Server (Docker, recommended for production)

docker compose up --build

This builds the KMS server image and starts it alongside a Redis cache, exposing the API on port 8500.

---

Usage

1. CLI Scanner — Auditing a Codebase

# Basic scan with console summary
sqrypt --target /path/to/codebase

# Export a NIST-aligned Cryptographic Bill of Materials
sqrypt --target /path/to/codebase --cbom cbom_report.json

# Export raw findings as JSON
sqrypt --target /path/to/codebase --output-json findings.json

# Generate a branded PDF audit report
sqrypt --target /path/to/codebase --pdf audit_report.pdf

Flag	Description
-t, --target	(Required) Path to the codebase to scan.
-j, --output-json	Save raw findings to a JSON file.
-c, --cbom	Export a standardized Cryptographic Bill of Materials.
-p, --pdf	Generate a formatted PDF audit report (optional custom path).

Detection coverage:

Category	Risk Class	Languages
RSA	Shor-vulnerable	Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex)
ECC / ECDSA	Shor-vulnerable	Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex)
Diffie-Hellman	Shor-vulnerable	Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex)
Legacy Hashes (MD5, SHA-1, SHA-224)	Deprecated	Python (AST), JS/TS/Java/C/C++/C#/Go/PHP (regex)
PQC Core (Kyber, ML-KEM, Dilithium, ML-DSA, SPHINCS+, SQrypt)	Quantum-resistant	All supported languages

Python files are parsed with the ast module for precise call-site tracking (imports, aliasing, and method invocation). All other supported languages use comment-aware, line-by-line regex matching. Scanning is parallelized across CPU cores via ProcessPoolExecutor, with live progress reporting via tqdm.

Risk scoring is derived from the volume and type of legacy primitives found, ranging from LOW (Quantum-Resistant Layer Deployed) through MEDIUM, HIGH, to CRITICAL.

2. SDK — Hybrid Encryption in Application Code

from sqrypt.client import SQryptClient

client = SQryptClient(
    server_url="https://your-kms-host:8500",
    api_key="STARTUP_BETA_2026"
)

# Encrypt a value
payload = client.encrypt("sensitive customer data")

# Decrypt it back
plaintext = client.decrypt(payload)

Decorator-based encryption:

@client.auto_encrypt()
def get_ssn():
    return "123-45-6789"

encrypted_payload = get_ssn()

Protecting specific fields in a dictionary:

record = {"name": "Jane Doe", "ssn": "123-45-6789", "email": "[e-mail]"}
protected = client.protect_dict(record, sensitive_keys=["ssn", "email"])

3. KMS Server — Self-Hosting

The KMS server issues per-tenant hybrid keypairs and performs decapsulation on behalf of authenticated clients.

cd kms-server
uvicorn server:app --host 0.0.0.0 --port 8000

Endpoint	Method	Description
/v2/public-keys	GET	Returns the tenant's ML-KEM-768 public key and X25519 public key.
/v2/decapsulate	POST	Accepts a PQC capsule + client X25519 public key, returns both shared secrets.

Authentication is enforced via the X-SQrypt-Key header against a tenant registry.

Production note: The bundled tenant registry (TENANT_VAULT) is an in-memory placeholder intended for development and demos. Production deployments should back tenant key material with a secure, encrypted data store (e.g. PostgreSQL or a hardware/cloud KMS) and rotate keys on a defined schedule.

---

Dependencies

SDK / CLI (pyproject.toml): cryptography, kyber-py, requests, fpdf, tqdm, rich

KMS Server (requirements.txt): fastapi, pydantic, uvicorn, gunicorn, kyber-py, cryptography

---

Project Status

SQrypt is an early-stage / alpha project under active development. The current build (v2.0.0) is functional for evaluation, internal auditing, and proof-of-concept integrations. Before any production or compliance-critical deployment, teams should:

• Replace the in-memory tenant vault with persistent, encrypted storage.
• Add key rotation, revocation, and audit logging to the KMS.
• Subject the CLI scanner's detection signatures to a false-positive/false-negative review against their specific codebase.
• Conduct an independent security review of the hybrid KEM implementation.

---

Roadmap

• Expanded language coverage for the CLI scanner (Rust, Ruby, Kotlin, Swift, Scala)
• CI/CD-friendly scan mode with configurable exit-code gating on risk threshold
• Persistent, multi-tenant KMS backend with key rotation and HSM/cloud KMS integration
• ML-DSA (Dilithium) digital signature support alongside the existing ML-KEM encryption layer
• Pluggable, externally configurable detection signature sets

---

Contributing

Issues and pull requests are welcome. Please open an issue describing the proposed change before submitting larger contributions, and include test coverage for any new detection signatures or SDK behavior.

---

License

Released under the MIT License.

Copyright (c) 2026 Aryan Sujay