swarmauri_mre_crypto_shamir

Shamir Secret Sharing based multi-recipient encryption (MRE) provider for the Swarmauri framework. The provider splits an AES-256-GCM content encryption key using Shamir's threshold scheme and distributes shares to recipients.

Features

• AES-256-GCM payload encryption
• Threshold k-of-n key sharing via Shamir secret sharing
• Envelope rewrapping with optional payload rotation
• Optional authenticated data (AAD) handling

Extras

The plugin supports optional canonicalization extras:

• cbor ? enables CBOR canonicalization via cbor2

Installation

Choose the tool that matches your workflow:

# pip
pip install swarmauri_mre_crypto_shamir

# Poetry
poetry add swarmauri_mre_crypto_shamir

# uv (project dependency)
uv add swarmauri_mre_crypto_shamir

# uv (one-off virtual environment)
uv pip install swarmauri_mre_crypto_shamir

Install extras, such as CBOR canonicalization support, with swarmauri_mre_crypto_shamir[cbor].

Quickstart

ShamirMreCrypto encrypts a payload with a fresh AES-256-GCM content encryption key, splits the key into Shamir shares, and stores the encrypted payload and shares in a multi-recipient envelope. Provide a threshold with opts["threshold_k"] (defaults to a simple majority) to control how many shares are required to decrypt.

import asyncio

from swarmauri_mre_crypto_shamir import ShamirMreCrypto


async def main() -> None:
    provider = ShamirMreCrypto()

    recipients = [
        {"kid": "alice"},
        {"kid": "bob"},
        {"kid": "carol"},
    ]

    plaintext = b"Secret launch codes"

    envelope = await provider.encrypt_for_many(
        recipients,
        plaintext,
        opts={"threshold_k": 2},
    )

    print("Mode:", envelope["mode"])
    print("Recipients:", [entry["id"] for entry in envelope["recipients"]])
    print(
        "Threshold:",
        int.from_bytes(envelope["shared"]["threshold_k"], "big"),
    )

    recovered = await provider.open_for_many(
        [{"kid": "alice"}, {"kid": "carol"}],
        envelope,
    )

    assert recovered == plaintext
    print("Recovered plaintext:", recovered.decode("utf-8"))


if __name__ == "__main__":
    asyncio.run(main())

Want to help?

If you want to contribute to swarmauri-sdk, read up on our guidelines for contributing that will help you get started.