OVERVIEW

• C library for encrypted network communications using AES-256-GCM and ChaCha20-Poly1305. Includes session management, key rotation, replay protection, packet fragmentation, and traffic obfuscation.

DEPENDENCIES

• OpenSSL (libssl, libcrypto)
• libsodium
• pthread

COMPILATION gcc -o sanctum sanctum.c -lssl -lcrypto -lsodium -lpthread -O2 -Wall

FEATURES

• Dual cipher support (AES-256-GCM, ChaCha20-Poly1305)
• HKDF key derivation
• Automatic key rotation after 100 packets
• Replay attack prevention with sliding window
• Packet fragmentation for large payloads
• Traffic obfuscation with random padding
• Multi-session management
• Secure memory handling with mlock

USAGE Initialize library:

  crypto_init()

Create session manager:

  session_manager_t *mgr = session_manager_create(master_secret)

Establish session:

  crypto_context_t *ctx = establish_session(mgr, peer_id, peer_id_len, 
                                            ephemeral_key, CIPHER_AES_256_GCM)

Encrypt data:

  encrypt_packet(ctx, plaintext, plaintext_len, &ciphertext, &ciphertext_len)

Decrypt data:

  decrypt_packet(ctx, ciphertext, ciphertext_len, &plaintext, &plaintext_len)

Send large data:

  send_fragmented(ctx, data, data_len, &fragments, &frag_lens, &num_fragments)

Receive fragments:

  receive_fragmented(ctx, fragments, frag_lens, num_fragments, &data, &data_len)

Close session:

  close_session(mgr, ctx)

Cleanup:

  session_manager_free(mgr)

TESTING Run built-in test suite: ./sanctum

Tests include encryption/decryption, key rotation, fragmentation, replay protection, and cipher modes.

SECURITY FEATURES

• Constant-time comparison for authentication tags
• Secure memory wiping on cleanup
• Memory locking for sensitive data
• Thread-safe operations with mutexes
• Protocol version checking
• Authenticated encryption with additional data (AEAD)

PACKET FORMAT [version:1][sequence:8][iv:12][ciphertext:N][tag:16]

LIMITATIONS

• Maximum packet size: 65535 bytes
• Replay window: 1024 packets
• Key rotation interval: 100 packets
• Fragment size: 1400 bytes

ERROR CODES;

CRYPTO_SUCCESS (0)
CRYPTO_ERR_ALLOC (-1)
CRYPTO_ERR_INVALID_PARAM (-2)
CRYPTO_ERR_ENCRYPT (-3)
CRYPTO_ERR_DECRYPT (-4)
CRYPTO_ERR_AUTH (-5)
CRYPTO_ERR_REPLAY (-6)
CRYPTO_ERR_PROTOCOL (-7)
CRYPTO_ERR_KEY_DERIVE (-8)
CRYPTO_ERR_SESSION (-9)