phylax 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e381c418f0f615ce325714db60e7859fb75be0584ed3cef79cdb39cf0a3ab5ce
-  data.tar.gz: 552fd46214a14a2faaa3038ec6f4bbd5a677367fb5e9740d894e8bf3605981bd
+  metadata.gz: f8a97badaa44fd356a5e414446dc937fa8796a5e9b9a670cc8d43f76048ee275
+  data.tar.gz: bbc4c29d490c2f4599a49b2fd055c8abf78d5c771b37e9135ca76dd1236c0a49
 SHA512:
-  metadata.gz: 4c77e2bf51d2a617e664cfc40c40fd91e79700c13d4d1a6ebc954909a24251b8dcc3cb48d84d8d9e5ead11964e3a18e60eaf48ef3ae49d92ac439e6044fe4fa3
-  data.tar.gz: 4901fb8c6cee2d011097a46f500009882475220ce30980676bd6dcbbeeb788be1fc0e948c61d9160ef6cd6971b1549e168bebeb83f44fe38295219ba5d1ec018
+  metadata.gz: 598b3a11263052f1fbd66dbe5eacb78924c470c312fb8484ab08c84998c15eb8828776c0f753e3146f2e8c98cf32a8c08b7462d74b57142f5f3768b7cd50493c
+  data.tar.gz: 1d17e2334c63d1c5d0a9e3257faaf93586a447dc859cd730ecb00c9adce40b4b75c6701f75852c28e26d86f0cc896fec3b88be5bf22c81077eb4791b0995d7fd

data/README.md

@@ -1,155 +1,11 @@
-# phylax
-
-**Misuse-resistant cryptography for Ruby, backed by the Windows CNG provider.**
-
-`phylax` (Greek *φύλαξ*, "guardian") is a thin, **safe-by-default** binding to the
-cryptography Windows already ships and validates: the **Cryptography API: Next
-Generation** (CNG / `bcrypt.dll`) and **DPAPI** (`crypt32.dll`). It implements no
-cryptography of its own — it exposes the operating system's own primitives through
-an ergonomic, hard-to-misuse API.
-
-The design goal is that the *easy* way is the *safe* way:
-
-- **Authenticated encryption that can't be nonce-reused.** `SecretBox` (AES-256-GCM)
-  generates a fresh 96-bit nonce on every `seal` and frames it into the output, so
-  the catastrophic GCM failure mode — reusing a `(key, nonce)` pair — is impossible
-  through the public API. There is no nonce parameter to get wrong.
-- **Decryption is all-or-nothing.** `open` verifies the authentication tag inside the
-  OS call and raises `Phylax::AuthenticationError` rather than ever returning
-  unauthenticated plaintext.
-- **No silent weakening.** A key that isn't exactly 32 bytes is a loud error, not a
-  silently-truncated AES-128 key. Only SHA-2 is accepted — `:md5`/`:sha1` raise.
-- **Constant-time comparison** is provided so you don't verify MACs with `==`.
-
-| What | API |
-|---|---|
-| Secure random | `Phylax.random_bytes(n)` |
-| Hashing (one-shot) | `Phylax.sha256(data)`, `.sha384`, `.sha512` |
-| Hashing (streaming) | `Phylax::Digest.new(:sha256)` |
-| HMAC (one-shot) | `Phylax.hmac_sha256(key, data)`, `.hmac_sha384`, `.hmac_sha512` |
-| HMAC (streaming) | `Phylax::HMAC.new(:sha256, key)`, `Phylax::HMAC.verify(...)` |
-| Key derivation | `Phylax.pbkdf2(password:, salt:, iterations:, length:, hash:)` |
-| Authenticated encryption | `Phylax::SecretBox` (AES-256-GCM) |
-| Constant-time compare | `Phylax.secure_compare(a, b)` |
-| Secrets at rest | `Phylax.protect(data, scope:, entropy:)` / `Phylax.unprotect` |
-
-## Requirements
-
-- **Windows** with a native **MSVC (mswin)** Ruby. Not supported on MinGW/UCRT.
-- Visual Studio 2017+ / Build Tools with the **Desktop development with C++** workload.
-
-## Install
-
-```sh
-gem install phylax
-```
-
-## Authenticated encryption — `SecretBox`
-
-```ruby
-require "phylax"
-
-key = Phylax::SecretBox.generate_key      # 32 cryptographically random bytes
-box = Phylax::SecretBox.new(key)
-
-sealed = box.seal("attack at dawn")       # => nonce ‖ ciphertext ‖ tag (binary)
-box.open(sealed)                          # => "attack at dawn"
-
-# Additional authenticated data (authenticated, not encrypted) — must match.
-sealed = box.seal(payload, aad: "v1:user-42")
-box.open(sealed, aad: "v1:user-42")       # ok
-box.open(sealed, aad: "v1:user-99")       # raises Phylax::AuthenticationError
-
-# Any tampering with the nonce, ciphertext, tag, or aad fails closed:
-box.open(sealed.tap { |s| s.setbyte(20, s.getbyte(20) ^ 1) })
-# => raises Phylax::AuthenticationError (no plaintext is returned)
-```
-
-Derive the key from a password instead (PBKDF2-HMAC-SHA256):
-
-```ruby
-salt = Phylax.random_bytes(16)            # store this alongside the ciphertext
-box  = Phylax::SecretBox.from_password("correct horse battery staple",
-                                       salt: salt, iterations: 600_000)
-```
-
-**Wire format.** `seal` returns `nonce (12 bytes) ‖ ciphertext (= plaintext length) ‖ tag (16 bytes)`,
-so the overhead is a constant `Phylax::SecretBox::OVERHEAD` (28) bytes. This is
-standard AES-256-GCM: a blob from `seal` can be decrypted by any GCM
-implementation (e.g. OpenSSL) given the same key, and vice versa.
-
-## Hashing and HMAC
-
-```ruby
-Phylax.sha256("data")                     # => 32 raw bytes (ASCII-8BIT)
-Phylax.sha256("data").unpack1("H*")       # => hex
-
-# Streaming — non-destructive #digest, so you can keep updating:
-d = Phylax::Digest.new(:sha256)
-d << "chunk one" << "chunk two"
-d.hexdigest
-
-Phylax.hmac_sha256(key, "message")        # keyed MAC, raw bytes
-
-# Verify a MAC the safe way (constant-time, never raises on mismatch):
-Phylax::HMAC.verify(:sha256, key, message, received_tag)   # => true / false
-```
-
-## Key derivation, random, and comparison
-
-```ruby
-Phylax.pbkdf2(password: pw, salt: salt, iterations: 600_000, length: 32)
-Phylax.random_bytes(16)                   # system CSPRNG (CTR_DRBG)
-Phylax.secure_compare(tag_a, tag_b)       # constant-time for equal-length inputs
-```
-
-## Secrets at rest — DPAPI
-
-`protect` encrypts data with a key the OS derives from the current user (default)
-or the machine, so the blob can only be read back on the same machine (and, for
-`:user` scope, by the same user). Great for storing a credential or a `SecretBox`
-key on disk without a master password.
-
-```ruby
-blob = Phylax.protect("api-token-value")          # bound to this Windows user
-Phylax.unprotect(blob)                             # => "api-token-value"
-
-# Optional second secret ("entropy") that must be supplied to unprotect:
-blob = Phylax.protect(secret, entropy: app_salt)
-Phylax.unprotect(blob, entropy: app_salt)
-
-# Machine scope: any account on this machine can unprotect.
-Phylax.protect(secret, scope: :machine)
-```
-
-## Errors
-
-```
-StandardError
-└─ Phylax::Error                 # base for everything phylax raises
-    ├─ Phylax::AuthenticationError  # GCM tag mismatch / tamper, or DPAPI integrity failure
-    └─ Phylax::OSError              # other Windows API failure (#api, #code)
-```
-
-`ArgumentError`/`TypeError` are raised for bad sizes or types *before* any OS call
-(e.g. a key that isn't 32 bytes, an unknown hash, a non-String input).
-
-## Security notes
-
-- **Algorithms.** AES-256-GCM (128-bit tag), SHA-256/384/512, HMAC-SHA-2,
-  PBKDF2-HMAC-SHA-2, `BCryptGenRandom` (SP 800-90A CTR_DRBG). All are the OS's
-  validated implementations; phylax only marshals bytes.
-- **Random-nonce limit.** With random 96-bit nonces, keep a single `SecretBox` key
-  under ~2³² messages (the GCM birthday bound). Rotate keys for very high volume.
-- **`secure_compare` leaks length.** It returns `false` immediately when lengths
-  differ and is constant-time only across equal-length inputs — fine for comparing
-  fixed-length MACs, which is its purpose.
-- **DPAPI tamper detection is best-effort.** Windows may return an error *or*, rarely,
-  succeed with corrupted output on a mangled blob. If you need a hard integrity
-  guarantee, wrap the data in a `SecretBox` (or add your own HMAC) first.
-- **Windows/MSVC only.** The extension links `bcrypt.lib` + `crypt32.lib` and is
-  built with `cl.exe` against a native-MSVC Ruby.
-
-## License
-
-[MIT](LICENSE.txt).
+# phylax (discontinued)
+
+**phylax is no longer maintained.** This final release (0.1.1) contains no
+code: installing it compiles nothing, and `require "phylax"` raises a
+`LoadError` explaining the discontinuation.
+
+Use Ruby's built-in openssl, lockbox or rbnacl instead.
+
+Earlier releases remain on RubyGems only because RubyGems does not allow
+versions older than 30 days to be yanked. They are unmaintained and not
+recommended.

data/lib/phylax.rb

@@ -1,252 +1,4 @@
-# frozen_string_literal: true
-
-require "phylax/version"
-require "phylax/phylax" # native extension: Phylax primitives + Digest/HMAC/SecretBox + errors
-
-# phylax — misuse-resistant cryptography for Ruby, backed by the Windows CNG
-# provider (bcrypt.dll) and DPAPI (crypt32.dll).
-#
-# It implements no cryptography itself; it is a thin, hard-to-misuse binding to
-# the operating system's own validated primitives.
-#
-#   key = Phylax::SecretBox.generate_key        # 32 secure random bytes
-#   box = Phylax::SecretBox.new(key)
-#   sealed = box.seal("attack at dawn")         # fresh nonce per call, authenticated
-#   box.open(sealed)                            # => "attack at dawn"
-#
-#   Phylax.sha256("data")                       # raw 32-byte digest
-#   Phylax.hmac_sha256(key, "msg")              # keyed MAC
-#   Phylax.pbkdf2(password: pw, salt: s, iterations: 600_000, length: 32)
-#   Phylax.random_bytes(16)
-#   Phylax.protect(secret)                      # DPAPI, bound to this user
-module Phylax
-  # The only hash algorithms the gem accepts, mapped to their C-side index.
-  HASHES = { sha256: 0, sha384: 1, sha512: 2 }.freeze
-
-  # The C bridge methods are internal plumbing; the public, validated API below
-  # wraps them. Keep them off the public surface so callers can't skip the
-  # keyword/size checks (e.g. a negative PBKDF2 iteration count).
-  private_class_method :__hash, :__hmac, :__pbkdf2, :__protect, :__unprotect
-
-  module_function
-
-  # --- one-shot hashing ----------------------------------------------------
-
-  def sha256(data) = __hash(0, data)
-  def sha384(data) = __hash(1, data)
-  def sha512(data) = __hash(2, data)
-
-  # --- one-shot HMAC -------------------------------------------------------
-
-  def hmac_sha256(key, data) = __hmac(0, key, data)
-  def hmac_sha384(key, data) = __hmac(1, key, data)
-  def hmac_sha512(key, data) = __hmac(2, key, data)
-
-  # --- PBKDF2 key derivation ----------------------------------------------
-
-  # Derive a key from a password and salt. Defaults to HMAC-SHA256.
-  #   password:   secret bytes (String)
-  #   salt:       non-secret bytes (String); must not be empty, >= 16 advised
-  #   iterations: PRF iteration count (Integer >= 1)
-  #   length:     desired key length in bytes (Integer >= 1)
-  #   hash:       :sha256 / :sha384 / :sha512
-  def pbkdf2(password:, salt:, iterations:, length:, hash: :sha256)
-    idx = HASHES.fetch(hash) { raise ArgumentError, "unknown hash #{hash.inspect}" }
-    raise ArgumentError, "iterations must be >= 1" if iterations < 1
-    raise ArgumentError, "length must be >= 1"     if length < 1
-    raise ArgumentError, "salt must not be empty"  if String(salt).empty?
-
-    __pbkdf2(idx, password, salt, iterations, length)
-  end
-
-  # --- DPAPI: protect secrets at rest -------------------------------------
-
-  # Encrypt +data+ with a key the OS derives from the current user (default)
-  # or the machine. The returned opaque blob can only be unprotected on the
-  # same machine (and, for :user scope, by the same user). An optional
-  # +entropy+ string acts as a second secret that must be supplied identically
-  # to #unprotect.
-  def protect(data, scope: :user, entropy: nil)
-    __protect(data, machine_scope!(scope), entropy)
-  end
-
-  # Reverse of #protect. Raises Phylax::AuthenticationError if the blob was
-  # tampered with, the wrong entropy was given, or it belongs to another
-  # user/machine. (DPAPI infers the scope from the blob; +scope+ is validated
-  # for symmetry but does not change the operation.)
-  def unprotect(data, scope: :user, entropy: nil)
-    machine_scope!(scope)
-    __unprotect(data, entropy)
-  end
-
-  def machine_scope!(scope)
-    case scope
-    when :user    then false
-    when :machine then true
-    else raise ArgumentError, "scope must be :user or :machine, got #{scope.inspect}"
-    end
-  end
-  private_class_method :machine_scope!
-
-  # Base class for every error phylax raises.
-  class Error < StandardError; end
-
-  # The data could not be authenticated: a SecretBox ciphertext (or its AAD)
-  # was tampered with or decrypted with the wrong key, or a DPAPI blob failed
-  # its integrity/credential check. Never trust any output when this is raised.
-  class AuthenticationError < Error; end
-
-  # A Windows API returned a failure we surface verbatim. #api names the call;
-  # #code is the NTSTATUS or Win32 error value.
-  class OSError < Error
-    def api  = @api
-    def code = @code
-  end
-
-  # Streaming message digest (SHA-256/384/512).
-  #
-  #   d = Phylax::Digest.new(:sha256)
-  #   d << "chunk one" << "chunk two"
-  #   d.hexdigest            # non-destructive; you may keep updating
-  class Digest
-    # Bytes in the final digest, keyed by algorithm symbol.
-    SIZES = { sha256: 32, sha384: 48, sha512: 64 }.freeze
-
-    attr_reader :name
-
-    def initialize(name)
-      idx = HASHES.fetch(name) { raise ArgumentError, "unknown hash #{name.inspect}" }
-      @name = name
-      _init(idx)
-    end
-
-    def <<(data)
-      update(data)
-    end
-
-    # Discard any fed data and start over.
-    def reset
-      _init(HASHES.fetch(@name))
-      self
-    end
-
-    def hexdigest
-      digest.unpack1("H*")
-    end
-
-    # Convenience: hash +data+ in one call.
-    def self.digest(name, data)
-      new(name).update(data).digest
-    end
-
-    def self.hexdigest(name, data)
-      digest(name, data).unpack1("H*")
-    end
-
-    def size
-      digest_length
-    end
-    alias length size
-
-    def inspect
-      "#<Phylax::Digest #{@name}>"
-    end
-
-    private :_init
-  end
-
-  # Streaming keyed MAC (HMAC-SHA-256/384/512).
-  #
-  #   m = Phylax::HMAC.new(:sha256, key)
-  #   m << "part one" << "part two"
-  #   m.hexdigest
-  class HMAC
-    attr_reader :name
-
-    def initialize(name, key)
-      idx = HASHES.fetch(name) { raise ArgumentError, "unknown hash #{name.inspect}" }
-      @name = name
-      _init(idx, key)
-    end
-
-    def <<(data)
-      update(data)
-    end
-
-    def hexdigest
-      digest.unpack1("H*")
-    end
-
-    def size
-      digest_length
-    end
-    alias length size
-
-    # Compute the MAC of +data+ under +key+ and compare it to +expected_tag+ in
-    # constant time. Returns true/false and never raises on mismatch — the safe
-    # way to verify a MAC.
-    def self.verify(name, key, data, expected_tag)
-      tag = new(name, key).update(data).digest
-      Phylax.secure_compare(tag, expected_tag)
-    end
-
-    def inspect
-      "#<Phylax::HMAC #{@name}>"
-    end
-
-    private :_init
-  end
-
-  # Authenticated symmetric encryption (AES-256-GCM) with a misuse-resistant
-  # API: a fresh 96-bit nonce is generated on every #seal and framed into the
-  # output, so nonce reuse is impossible by construction, and #open refuses to
-  # return anything that fails authentication.
-  class SecretBox
-    KEY_BYTES   = 32
-    NONCE_BYTES = 12
-    TAG_BYTES   = 16
-    OVERHEAD    = NONCE_BYTES + TAG_BYTES # bytes #seal adds over the plaintext
-
-    # A new random 32-byte key.
-    def self.generate_key
-      Phylax.random_bytes(KEY_BYTES)
-    end
-
-    # Derive a box's key from a password via PBKDF2-HMAC-SHA256. +salt+ is
-    # required and should be random and stored alongside the ciphertext.
-    def self.from_password(password, salt:, iterations: 600_000)
-      key = Phylax.pbkdf2(password: password, salt: salt,
-                          iterations: iterations, length: KEY_BYTES, hash: :sha256)
-      new(key)
-    end
-
-    # +key+ must be exactly 32 bytes (e.g. from .generate_key or .from_password).
-    def initialize(key)
-      key = String(key)
-      unless key.bytesize == KEY_BYTES
-        raise ArgumentError, "key must be exactly #{KEY_BYTES} bytes, got #{key.bytesize}"
-      end
-      _init(key)
-    end
-
-    # Encrypt and authenticate +plaintext+. Optional +aad+ (additional
-    # authenticated data) is authenticated but not encrypted, and must be
-    # supplied identically to #open. Returns nonce ‖ ciphertext ‖ tag.
-    def seal(plaintext, aad: nil)
-      _seal(plaintext, aad)
-    end
-
-    # Verify and decrypt a blob from #seal. Raises Phylax::AuthenticationError
-    # if the ciphertext, tag, nonce, or aad don't match (or the blob is too
-    # short to be authentic).
-    def open(sealed, aad: nil)
-      _open(sealed, aad)
-    end
-
-    def inspect
-      "#<Phylax::SecretBox>" # never expose key material
-    end
-
-    private :_init, :_seal, :_open
-  end
-end
+# frozen_string_literal: true
+
+raise LoadError, "phylax is discontinued and this release contains no code. Use Ruby's built-in openssl, lockbox or rbnacl instead." \
+  " Earlier phylax releases are unmaintained and not recommended."

metadata

@@ -1,106 +1,30 @@
 --- !ruby/object:Gem::Specification
 name: phylax
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - ned
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-- !ruby/object:Gem::Dependency
-  name: rake-compiler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: vcvars
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.1
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.1
-description: |
-  phylax (Greek "guardian") is a thin, safe-by-default binding to the Windows
-  Cryptography API: Next Generation (CNG / bcrypt.dll) and DPAPI. It does not
-  implement any cryptography of its own — it exposes the operating system's own
-  validated primitives through an ergonomic, hard-to-misuse Ruby API: a
-  cryptographically secure RNG, SHA-2 hashing and HMAC (one-shot and streaming),
-  PBKDF2 key derivation, authenticated AES-256-GCM encryption (SecretBox, with
-  nonces generated and framed automatically so reuse is impossible), a
-  constant-time comparison, and DPAPI protect/unprotect for secrets at rest.
-  Windows MSVC (mswin) Ruby only.
+dependencies: []
+description: phylax is discontinued. This final release contains no code and exists
+  only so that installing phylax explains the discontinuation instead of building
+  an unmaintained native extension.
 executables: []
-extensions:
-- ext/phylax/extconf.rb
+extensions: []
 extra_rdoc_files: []
 files:
-- CHANGELOG.md
 - LICENSE.txt
 - README.md
-- ext/phylax/extconf.rb
-- ext/phylax/phylax.c
 - lib/phylax.rb
-- lib/phylax/version.rb
-homepage: https://github.com/main-path/phylax
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/main-path/phylax
-  changelog_uri: https://github.com/main-path/phylax/blob/main/CHANGELOG.md
-  bug_tracker_uri: https://github.com/main-path/phylax/issues
   rubygems_mfa_required: 'true'
+post_install_message: phylax is discontinued and this release contains no code. Use
+  Ruby's built-in openssl, lockbox or rbnacl instead.
 rdoc_options: []
 require_paths:
 - lib
@@ -108,7 +32,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '2.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -117,5 +41,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: Misuse-resistant cryptography for Ruby, backed by the Windows CNG provider.
+summary: Discontinued. Use Ruby's built-in openssl, lockbox or rbnacl instead.
 test_files: []

data/CHANGELOG.md

@@ -1,23 +0,0 @@
-# Changelog
-
-## [0.1.0] - 2026-06-01
-
-Initial release.
-
-- `Phylax::SecretBox` — authenticated AES-256-GCM encryption with automatic,
-  per-message random nonces framed as `nonce ‖ ciphertext ‖ tag`; nonce reuse is
-  impossible through the public API. `seal`/`open` with optional AAD,
-  `generate_key`, and `from_password` (PBKDF2-HMAC-SHA256).
-- `Phylax.sha256/sha384/sha512` and streaming `Phylax::Digest` (non-destructive
-  `#digest` via `BCryptDuplicateHash`).
-- `Phylax.hmac_sha256/sha384/sha512`, streaming `Phylax::HMAC`, and the
-  constant-time `Phylax::HMAC.verify`.
-- `Phylax.pbkdf2` (HMAC-SHA-2 PRF; releases the GVL during derivation).
-- `Phylax.random_bytes` (system-preferred CSPRNG).
-- `Phylax.secure_compare` (constant-time for equal-length inputs).
-- `Phylax.protect` / `Phylax.unprotect` — DPAPI secrets at rest, user or machine
-  scope, optional entropy.
-- Error taxonomy: `Phylax::Error`, `Phylax::AuthenticationError`, `Phylax::OSError`.
-
-Built on the Windows CNG provider (`bcrypt.dll`) and DPAPI (`crypt32.dll`); no
-cryptography is implemented in the gem itself. Windows MSVC (mswin) Ruby only.

data/ext/phylax/extconf.rb

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-#
-# extconf.rb for the phylax extension — ergonomic Ruby bindings to the Windows
-# Cryptography API: Next Generation (CNG / bcrypt.dll) plus DPAPI (crypt32.dll).
-
-require "mkmf"
-
-unless RbConfig::CONFIG["target_os"] =~ /mswin/
-  abort <<~MSG
-    phylax requires a native Windows MSVC (mswin) Ruby — it binds the Windows
-    CNG primitive provider (bcrypt.dll) and DPAPI (crypt32.dll) and is built
-    with cl.exe. Your Ruby is "#{RbConfig::CONFIG['arch']}".
-  MSG
-end
-
-# CNG primitives (BCrypt*) and DPAPI (CryptProtectData/CryptUnprotectData).
-# Pure C — no -EHsc, so rb_raise/longjmp is the normal, safe error mechanism.
-$libs = [$libs, "bcrypt.lib", "crypt32.lib"].join(" ")
-
-create_makefile("phylax/phylax")