crypto-toolkit-py 1.0.0__tar.gz

crypto_toolkit_py-1.0.0/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 1.0.0 - 2026-08-29
+
+- Initial Python release
+- Safe hashing (SHA-2, SHA-3, BLAKE2) with HMAC
+- Password hashing and key derivation (PBKDF2, scrypt, Argon2id, bcrypt)
+- AEAD symmetric encryption (AES-256-GCM, ChaCha20-Poly1305)
+- Ed25519 digital signatures

crypto_toolkit_py-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Parthiv Rawat
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crypto_toolkit_py-1.0.0/MANIFEST.in

@@ -0,0 +1,7 @@
+include README.md
+include LICENSE
+include CHANGELOG.md
+include pyproject.toml
+recursive-include crypto_toolkit *.py py.typed
+recursive-exclude * __pycache__
+recursive-exclude * *.py[co]

crypto_toolkit_py-1.0.0/PKG-INFO

@@ -0,0 +1,116 @@
+Metadata-Version: 2.4
+Name: crypto-toolkit-py
+Version: 1.0.0
+Summary: Modern Cryptography & Hashing Toolkit - a misuse-resistant, high-level cryptography library for Python
+Author-email: Parthiv Rawat <parthiv05022000@gmail.com>
+Maintainer-email: Parthiv Rawat <parthiv05022000@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/parthivrawat/crypto-toolkit-py
+Project-URL: Documentation, https://github.com/parthivrawat/crypto-toolkit-py/tree/main/python#readme
+Project-URL: Repository, https://github.com/parthivrawat/crypto-toolkit-py
+Project-URL: Bug Tracker, https://github.com/parthivrawat/crypto-toolkit-py/issues
+Project-URL: Changelog, https://github.com/parthivrawat/crypto-toolkit-py/blob/main/python/CHANGELOG.md
+Keywords: crypto,cryptography,hash,hashing,hmac,password,encryption,argon2,ed25519,security
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: crypto
+Requires-Dist: cryptography>=43.0.0; extra == "crypto"
+Provides-Extra: argon2
+Requires-Dist: argon2-cffi>=23.1.0; extra == "argon2"
+Provides-Extra: bcrypt
+Requires-Dist: bcrypt>=4.0.0; extra == "bcrypt"
+Provides-Extra: full
+Requires-Dist: cryptography>=43.0.0; extra == "full"
+Requires-Dist: argon2-cffi>=23.1.0; extra == "full"
+Requires-Dist: bcrypt>=4.0.0; extra == "full"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
+Requires-Dist: mypy>=1.0.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# Modern Cryptography & Hashing Toolkit (Python)
+
+A misuse-resistant, high-level cryptography library with safe defaults, constant-time verification, and a clear API for hashing, password hashing, key derivation, symmetric encryption, HMAC, and digital signatures.
+
+## Features
+
+- **Safe hashing**: SHA-256, SHA-384, SHA-512, SHA-3, BLAKE2 (MD5 and SHA-1 rejected)
+- **HMAC**: Constant-time verification
+- **Password hashing**: PBKDF2-SHA256, scrypt, Argon2id, bcrypt with adaptive costs
+- **Key derivation**: PBKDF2 and scrypt
+- **Symmetric encryption**: AES-256-GCM or ChaCha20-Poly1305 with automatic nonce management
+- **Digital signatures**: Ed25519
+- **Zero runtime dependencies** for core hashing, HMAC, and key derivation
+- **Optional extras** for AEAD encryption and signatures (`[crypto]`), Argon2id (`[argon2]`), and bcrypt (`[bcrypt]`)
+
+## Installation
+
+```bash
+pip install crypto-toolkit-py
+```
+
+With all optional dependencies:
+
+```bash
+pip install "crypto-toolkit-py[full]"
+```
+
+## Quick Start
+
+```python
+from crypto_toolkit import hash, password, encrypt, sign
+
+# Safe, deterministic hashing
+sha256 = hash.string('hello world', algorithm='sha-256')
+print(sha256)
+
+mac = hash.hmac('secret-key', 'message', algorithm='sha-256')
+assert hash.verify_hmac(mac, 'secret-key', 'message', algorithm='sha-256')
+
+# Password hashing
+ph = password.hash('user-password')
+assert password.verify('user-password', ph)
+
+# Key derivation
+salt = b'16-or-more-random-bytes'
+key = password.derive('passphrase', salt=salt, length=32)
+
+# Symmetric encryption (requires cryptography)
+ciphertext = encrypt.symmetric('sensitive data', key=key)
+plaintext = encrypt.decrypt(ciphertext, key=key)
+assert plaintext == 'sensitive data'
+
+# Digital signatures (requires cryptography)
+private_key, public_key = sign.generate_keypair()
+signature = sign.ed25519('message', private_key=private_key)
+assert sign.verify(signature, 'message', public_key=public_key)
+```
+
+## Development
+
+```bash
+cd implementations/security/crypto-toolkit/python
+pip install -e ".[dev,full]"
+pytest test_crypto_toolkit.py -v
+```
+
+## License
+
+MIT License

crypto_toolkit_py-1.0.0/README.md

@@ -0,0 +1,69 @@
+# Modern Cryptography & Hashing Toolkit (Python)
+
+A misuse-resistant, high-level cryptography library with safe defaults, constant-time verification, and a clear API for hashing, password hashing, key derivation, symmetric encryption, HMAC, and digital signatures.
+
+## Features
+
+- **Safe hashing**: SHA-256, SHA-384, SHA-512, SHA-3, BLAKE2 (MD5 and SHA-1 rejected)
+- **HMAC**: Constant-time verification
+- **Password hashing**: PBKDF2-SHA256, scrypt, Argon2id, bcrypt with adaptive costs
+- **Key derivation**: PBKDF2 and scrypt
+- **Symmetric encryption**: AES-256-GCM or ChaCha20-Poly1305 with automatic nonce management
+- **Digital signatures**: Ed25519
+- **Zero runtime dependencies** for core hashing, HMAC, and key derivation
+- **Optional extras** for AEAD encryption and signatures (`[crypto]`), Argon2id (`[argon2]`), and bcrypt (`[bcrypt]`)
+
+## Installation
+
+```bash
+pip install crypto-toolkit-py
+```
+
+With all optional dependencies:
+
+```bash
+pip install "crypto-toolkit-py[full]"
+```
+
+## Quick Start
+
+```python
+from crypto_toolkit import hash, password, encrypt, sign
+
+# Safe, deterministic hashing
+sha256 = hash.string('hello world', algorithm='sha-256')
+print(sha256)
+
+mac = hash.hmac('secret-key', 'message', algorithm='sha-256')
+assert hash.verify_hmac(mac, 'secret-key', 'message', algorithm='sha-256')
+
+# Password hashing
+ph = password.hash('user-password')
+assert password.verify('user-password', ph)
+
+# Key derivation
+salt = b'16-or-more-random-bytes'
+key = password.derive('passphrase', salt=salt, length=32)
+
+# Symmetric encryption (requires cryptography)
+ciphertext = encrypt.symmetric('sensitive data', key=key)
+plaintext = encrypt.decrypt(ciphertext, key=key)
+assert plaintext == 'sensitive data'
+
+# Digital signatures (requires cryptography)
+private_key, public_key = sign.generate_keypair()
+signature = sign.ed25519('message', private_key=private_key)
+assert sign.verify(signature, 'message', public_key=public_key)
+```
+
+## Development
+
+```bash
+cd implementations/security/crypto-toolkit/python
+pip install -e ".[dev,full]"
+pytest test_crypto_toolkit.py -v
+```
+
+## License
+
+MIT License

crypto_toolkit_py-1.0.0/crypto_toolkit/__init__.py

@@ -0,0 +1,34 @@
+"""Modern Cryptography & Hashing Toolkit for Python.
+
+A misuse-resistant, high-level cryptography library with safe defaults,
+constant-time verification, and clear APIs for hashing, password hashing,
+key derivation, symmetric encryption, HMAC, and digital signatures.
+"""
+
+from . import encrypt, hash, password, sign
+from .exceptions import (
+    AlgorithmError,
+    CryptoKitError,
+    DecryptionError,
+    InvalidKeyError,
+    MissingDependencyError,
+    SignatureError,
+    VerificationError,
+)
+
+__version__ = "1.0.0"
+
+__all__ = [
+    "AlgorithmError",
+    "CryptoKitError",
+    "DecryptionError",
+    "InvalidKeyError",
+    "MissingDependencyError",
+    "SignatureError",
+    "VerificationError",
+    "__version__",
+    "encrypt",
+    "hash",
+    "password",
+    "sign",
+]

crypto_toolkit_py-1.0.0/crypto_toolkit/encrypt.py

@@ -0,0 +1,109 @@
+"""Symmetric AEAD encryption with safe, modern defaults."""
+
+import secrets
+from typing import Optional, Union
+
+from .exceptions import AlgorithmError, DecryptionError, InvalidKeyError, MissingDependencyError
+
+try:
+    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+    from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305
+
+    _HAS_CRYPTOGRAPHY = True
+except Exception:  # pragma: no cover
+    _HAS_CRYPTOGRAPHY = False
+
+_VERSION = 1
+
+_ALGORITHMS: dict = {}
+if _HAS_CRYPTOGRAPHY:
+    _ALGORITHMS = {
+        "aes-256-gcm": {
+            "id": 1,
+            "key_len": 32,
+            "nonce_len": 12,
+            "cipher_cls": AESGCM,
+        },
+        "chacha20-poly1305": {
+            "id": 2,
+            "key_len": 32,
+            "nonce_len": 12,
+            "cipher_cls": ChaCha20Poly1305,
+        },
+    }
+
+_ALGO_BY_ID = {v["id"]: k for k, v in _ALGORITHMS.items()}
+
+
+def _require_crypto():
+    if not _HAS_CRYPTOGRAPHY:
+        raise MissingDependencyError(
+            "AEAD encryption requires cryptography. Install: pip install 'crypto-toolkit-py[crypto]'"
+        )
+
+
+def _load_algorithm(algorithm: str) -> dict:
+    try:
+        return _ALGORITHMS[algorithm]
+    except KeyError:
+        raise AlgorithmError(f"Unsupported cipher: {algorithm}")
+
+
+def _make_cipher(algorithm: str, key: bytes):
+    spec = _load_algorithm(algorithm)
+    if len(key) != spec["key_len"]:
+        raise InvalidKeyError(f"{algorithm} requires a {spec['key_len']}-byte key")
+    return spec["cipher_cls"](key)
+
+
+def symmetric(data: Union[str, bytes], key: bytes, algorithm: str = "aes-256-gcm") -> bytes:
+    """Encrypt ``data`` with an AEAD cipher using a versioned header."""
+    _require_crypto()
+    if isinstance(data, str):
+        data = data.encode("utf-8")
+
+    spec = _load_algorithm(algorithm)
+    cipher = _make_cipher(algorithm, key)
+    nonce = secrets.token_bytes(spec["nonce_len"])
+    ciphertext = cipher.encrypt(nonce, data, None)
+    return bytes([_VERSION, spec["id"]]) + nonce + ciphertext
+
+
+def decrypt(token: bytes, key: bytes, encoding: Optional[str] = "utf-8") -> Union[str, bytes]:
+    """Decrypt and authenticate a token produced by ``symmetric``."""
+    _require_crypto()
+    if len(token) < 2:
+        raise DecryptionError("Ciphertext too short")
+
+    version = token[0]
+    if version != _VERSION:
+        raise DecryptionError(f"Unsupported ciphertext version: {version}")
+
+    algo_id = token[1]
+    algorithm = _ALGO_BY_ID.get(algo_id)
+    if algorithm is None:
+        raise DecryptionError(f"Unknown algorithm id: {algo_id}")
+
+    spec = _load_algorithm(algorithm)
+    if len(key) != spec["key_len"]:
+        raise InvalidKeyError(f"{algorithm} requires a {spec['key_len']}-byte key")
+
+    nonce_len = spec["nonce_len"]
+    if len(token) < 2 + nonce_len + 16:
+        raise DecryptionError("Ciphertext too short")
+
+    nonce = token[2 : 2 + nonce_len]
+    ciphertext = token[2 + nonce_len :]
+    cipher = _make_cipher(algorithm, key)
+
+    try:
+        plaintext = cipher.decrypt(nonce, ciphertext, None)
+    except Exception as exc:
+        raise DecryptionError("Decryption or authentication failed") from exc
+
+    if encoding:
+        try:
+            return plaintext.decode(encoding)
+        except UnicodeDecodeError:
+            return plaintext
+    return plaintext

crypto_toolkit_py-1.0.0/crypto_toolkit/exceptions.py

@@ -0,0 +1,36 @@
+"""Exceptions raised by the crypto toolkit."""
+
+
+class CryptoKitError(Exception):
+    """Base exception for the crypto toolkit."""
+    pass
+
+
+class AlgorithmError(CryptoKitError):
+    """Raised when an invalid or unsafe algorithm is requested."""
+    pass
+
+
+class InvalidKeyError(CryptoKitError):
+    """Raised when a key is malformed or has an incorrect length."""
+    pass
+
+
+class DecryptionError(CryptoKitError):
+    """Raised when decryption or authentication fails."""
+    pass
+
+
+class SignatureError(CryptoKitError):
+    """Raised when a signature operation fails."""
+    pass
+
+
+class MissingDependencyError(CryptoKitError):
+    """Raised when an optional dependency is required but not installed."""
+    pass
+
+
+class VerificationError(CryptoKitError):
+    """Raised when a password hash format is malformed."""
+    pass

crypto_toolkit_py-1.0.0/crypto_toolkit/hash.py

@@ -0,0 +1,72 @@
+"""Deterministic hashing and HMAC with safe, modern defaults."""
+
+import hashlib
+import hmac as _hmac
+from pathlib import Path
+from typing import Union
+
+from .exceptions import AlgorithmError
+
+_ALLOWED_HASH = frozenset(
+    {
+        "sha-256",
+        "sha-384",
+        "sha-512",
+        "sha3-256",
+        "sha3-384",
+        "sha3-512",
+        "blake2b",
+        "blake2s",
+    }
+)
+
+_HASHLIB_NAME = {
+    "sha-256": "sha256",
+    "sha-384": "sha384",
+    "sha-512": "sha512",
+    "sha3-256": "sha3_256",
+    "sha3-384": "sha3_384",
+    "sha3-512": "sha3_512",
+    "blake2b": "blake2b",
+    "blake2s": "blake2s",
+}
+
+
+def _normalize(algorithm: str) -> str:
+    name = algorithm.lower().replace("_", "-")
+    if name not in _ALLOWED_HASH:
+        raise AlgorithmError(f"Unsupported or unsafe hashing algorithm: {algorithm}")
+    return _HASHLIB_NAME[name]
+
+
+def _to_bytes(data: Union[str, bytes]) -> bytes:
+    return data.encode("utf-8") if isinstance(data, str) else data
+
+
+def string(data: Union[str, bytes], algorithm: str = "sha-256") -> str:
+    """Return a safe, deterministic hash of ``data`` as a hex string."""
+    digestmod = _normalize(algorithm)
+    return hashlib.new(digestmod, _to_bytes(data)).hexdigest()
+
+
+def file(path: Union[str, Path], algorithm: str = "sha-256", block_size: int = 8192) -> str:
+    """Return the hash of a file as a hex string."""
+    digestmod = _normalize(algorithm)
+    h = hashlib.new(digestmod)
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(block_size), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def hmac(key: Union[str, bytes], data: Union[str, bytes], algorithm: str = "sha-256") -> str:
+    """Return an HMAC of ``data`` as a hex string."""
+    digestmod = _normalize(algorithm)
+    mac = _hmac.new(_to_bytes(key), _to_bytes(data), digestmod)
+    return mac.hexdigest()
+
+
+def verify_hmac(mac: str, key: Union[str, bytes], data: Union[str, bytes], algorithm: str = "sha-256") -> bool:
+    """Verify an HMAC in constant time."""
+    expected = hmac(key, data, algorithm)
+    return _hmac.compare_digest(mac, expected)

crypto_toolkit_py-1.0.0/crypto_toolkit/password.py

@@ -0,0 +1,203 @@
+"""Password hashing, verification, and key derivation with safe defaults."""
+
+import base64
+import hashlib
+import hmac as _hmac
+import secrets
+from typing import Any, Optional, Union
+
+from .exceptions import AlgorithmError, MissingDependencyError, VerificationError
+
+try:
+    from argon2 import PasswordHasher as _Argon2Hasher
+    from argon2 import Type as _Argon2Type
+
+    _HAS_ARGON2 = True
+except Exception:  # pragma: no cover
+    _HAS_ARGON2 = False
+
+try:
+    import bcrypt as _bcrypt
+
+    _HAS_BCRYPT = True
+except Exception:  # pragma: no cover
+    _HAS_BCRYPT = False
+
+_ALLOWED = frozenset({"argon2id", "scrypt", "bcrypt", "pbkdf2_sha256"})
+
+
+def _scrypt_available() -> bool:
+    try:
+        hashlib.scrypt(b"", salt=b"", n=2, r=1, p=1, dklen=1, maxmem=1024)
+        return True
+    except Exception:
+        return False
+
+
+_SCRYPT_AVAILABLE = _scrypt_available()
+
+_DEFAULT = (
+    "argon2id"
+    if _HAS_ARGON2
+    else ("scrypt" if _SCRYPT_AVAILABLE else "pbkdf2_sha256")
+)
+
+
+def _to_bytes(value: Union[str, bytes]) -> bytes:
+    return value.encode("utf-8") if isinstance(value, str) else value
+
+
+def _parse_pbkdf2(hashed: str):
+    try:
+        _, iterations, salt_b64, key_b64 = hashed.split("$")
+        return int(iterations), base64.b64decode(salt_b64), base64.b64decode(key_b64)
+    except Exception as exc:
+        raise VerificationError("Invalid PBKDF2 hash format") from exc
+
+
+def _parse_scrypt(hashed: str):
+    try:
+        _, n, r, p, salt_b64, key_b64 = hashed.split("$")
+        return (
+            int(n),
+            int(r),
+            int(p),
+            base64.b64decode(salt_b64),
+            base64.b64decode(key_b64),
+        )
+    except Exception as exc:
+        raise VerificationError("Invalid scrypt hash format") from exc
+
+
+def hash(password: str, algorithm: Optional[str] = None, **params: Any) -> str:
+    """Hash a password with the strongest available algorithm by default."""
+    algo = algorithm or _DEFAULT
+    if algo not in _ALLOWED:
+        raise AlgorithmError(f"Unsupported password algorithm: {algo}")
+
+    if algo == "argon2id":
+        if not _HAS_ARGON2:
+            raise MissingDependencyError(
+                "Argon2id requires argon2-cffi. Install: pip install 'crypto-toolkit-py[argon2]'"
+            )
+        ph = _Argon2Hasher(
+            time_cost=params.get("time_cost", 3),
+            memory_cost=params.get("memory_cost", 65536),
+            parallelism=params.get("parallelism", 4),
+            type=_Argon2Type.ID,
+        )
+        return ph.hash(password)
+
+    if algo == "bcrypt":
+        if not _HAS_BCRYPT:
+            raise MissingDependencyError(
+                "bcrypt requires the bcrypt package. Install: pip install 'crypto-toolkit-py[bcrypt]'"
+            )
+        salt = _bcrypt.gensalt(rounds=params.get("rounds", 12))
+        return _bcrypt.hashpw(password.encode(), salt).decode("ascii")
+
+    if algo == "scrypt":
+        if not _SCRYPT_AVAILABLE:
+            raise MissingDependencyError("scrypt is not available on this platform")
+        salt = secrets.token_bytes(32)
+        n = params.get("n", 16384)
+        r = params.get("r", 8)
+        p = params.get("p", 1)
+        dklen = params.get("dklen", 64)
+        key = hashlib.scrypt(
+            password.encode(),
+            salt=salt,
+            n=n,
+            r=r,
+            p=p,
+            dklen=dklen,
+            maxmem=params.get("maxmem", 0),
+        )
+        return f"scrypt${n}${r}${p}${base64.b64encode(salt).decode()}${base64.b64encode(key).decode()}"
+
+    # pbkdf2_sha256
+    iterations = params.get("iterations", 100_000)
+    salt = secrets.token_bytes(32)
+    key = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, iterations)
+    return f"pbkdf2_sha256${iterations}${base64.b64encode(salt).decode()}${base64.b64encode(key).decode()}"
+
+
+def verify(password: str, hashed: str) -> bool:
+    """Verify a password against a hash in constant time."""
+    try:
+        if hashed.startswith("$argon2id$"):
+            if not _HAS_ARGON2:
+                return False
+            ph = _Argon2Hasher()
+            ph.verify(hashed, password)
+            return True
+
+        if hashed.startswith("$2") and len(hashed) >= 59:
+            if not _HAS_BCRYPT:
+                return False
+            return _bcrypt.checkpw(password.encode(), hashed.encode())
+
+        if hashed.startswith("scrypt$"):
+            if not _SCRYPT_AVAILABLE:
+                return False
+            n, r, p, salt, stored_key = _parse_scrypt(hashed)
+            candidate = hashlib.scrypt(
+                password.encode(),
+                salt=salt,
+                n=n,
+                r=r,
+                p=p,
+                dklen=len(stored_key),
+                maxmem=0,
+            )
+            return _hmac.compare_digest(candidate, stored_key)
+
+        if hashed.startswith("pbkdf2_sha256$"):
+            iterations, salt, stored_key = _parse_pbkdf2(hashed)
+            candidate = hashlib.pbkdf2_hmac(
+                "sha256",
+                password.encode(),
+                salt,
+                iterations,
+                dklen=len(stored_key),
+            )
+            return _hmac.compare_digest(candidate, stored_key)
+    except Exception:
+        return False
+
+    return False
+
+
+def derive(
+    passphrase: Union[str, bytes],
+    salt: Optional[bytes] = None,
+    length: int = 32,
+    algorithm: str = "pbkdf2_sha256",
+    **params: Any,
+) -> bytes:
+    """Derive a key from a passphrase and salt."""
+    if salt is None:
+        raise AlgorithmError("A non-None salt is required for deterministic key derivation")
+    if length < 1:
+        raise AlgorithmError("length must be a positive integer")
+
+    p = _to_bytes(passphrase)
+
+    if algorithm == "pbkdf2_sha256":
+        iterations = params.get("iterations", 100_000)
+        return hashlib.pbkdf2_hmac("sha256", p, salt, iterations, dklen=length)
+
+    if algorithm == "scrypt":
+        if not _SCRYPT_AVAILABLE:
+            raise MissingDependencyError("scrypt is not available on this platform")
+        return hashlib.scrypt(
+            p,
+            salt=salt,
+            n=params.get("n", 16384),
+            r=params.get("r", 8),
+            p=params.get("p", 1),
+            dklen=length,
+            maxmem=params.get("maxmem", 0),
+        )
+
+    raise AlgorithmError(f"Unsupported key derivation algorithm: {algorithm}")

crypto_toolkit_py-1.0.0/crypto_toolkit/sign.py

@@ -0,0 +1,79 @@
+"""Digital signatures (Ed25519, ECDSA, RSA-PSS)."""
+
+from typing import Tuple, Union
+
+from .exceptions import AlgorithmError, InvalidKeyError, MissingDependencyError, SignatureError
+
+try:
+    from cryptography.exceptions import InvalidSignature
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import ed25519 as _ed25519
+
+    _HAS_CRYPTOGRAPHY = True
+except Exception:  # pragma: no cover
+    _HAS_CRYPTOGRAPHY = False
+
+
+def _require_crypto():
+    if not _HAS_CRYPTOGRAPHY:
+        raise MissingDependencyError(
+            "Digital signatures require cryptography. Install: pip install 'crypto-toolkit-py[crypto]'"
+        )
+
+
+def _to_bytes(value: Union[str, bytes]) -> bytes:
+    return value.encode("utf-8") if isinstance(value, str) else value
+
+
+def generate_keypair(algorithm: str = "ed25519") -> Tuple[bytes, bytes]:
+    """Generate a private/public key pair for the requested algorithm."""
+    _require_crypto()
+    if algorithm != "ed25519":
+        raise AlgorithmError("Only ed25519 is currently supported")
+
+    private = _ed25519.Ed25519PrivateKey.generate()
+    public = private.public_key()
+    return (
+        private.private_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PrivateFormat.Raw,
+            encryption_algorithm=serialization.NoEncryption(),
+        ),
+        public.public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        ),
+    )
+
+
+def ed25519(message: Union[str, bytes], private_key: bytes) -> bytes:
+    """Sign ``message`` with an Ed25519 private key."""
+    _require_crypto()
+    if len(private_key) != 32:
+        raise InvalidKeyError("Ed25519 private key must be 32 bytes")
+
+    sk = _ed25519.Ed25519PrivateKey.from_private_bytes(private_key)
+    return sk.sign(_to_bytes(message))
+
+
+def verify(
+    signature: bytes,
+    message: Union[str, bytes],
+    public_key: bytes,
+    algorithm: str = "ed25519",
+) -> bool:
+    """Verify a signature against a message and public key."""
+    _require_crypto()
+    if algorithm != "ed25519":
+        raise AlgorithmError("Only ed25519 is currently supported")
+    if len(public_key) != 32:
+        raise InvalidKeyError("Ed25519 public key must be 32 bytes")
+
+    vk = _ed25519.Ed25519PublicKey.from_public_bytes(public_key)
+    try:
+        vk.verify(signature, _to_bytes(message))
+        return True
+    except InvalidSignature:
+        return False
+    except Exception as exc:
+        raise SignatureError("Signature verification failed") from exc

crypto_toolkit_py-1.0.0/crypto_toolkit_py.egg-info/PKG-INFO

@@ -0,0 +1,116 @@
+Metadata-Version: 2.4
+Name: crypto-toolkit-py
+Version: 1.0.0
+Summary: Modern Cryptography & Hashing Toolkit - a misuse-resistant, high-level cryptography library for Python
+Author-email: Parthiv Rawat <parthiv05022000@gmail.com>
+Maintainer-email: Parthiv Rawat <parthiv05022000@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/parthivrawat/crypto-toolkit-py
+Project-URL: Documentation, https://github.com/parthivrawat/crypto-toolkit-py/tree/main/python#readme
+Project-URL: Repository, https://github.com/parthivrawat/crypto-toolkit-py
+Project-URL: Bug Tracker, https://github.com/parthivrawat/crypto-toolkit-py/issues
+Project-URL: Changelog, https://github.com/parthivrawat/crypto-toolkit-py/blob/main/python/CHANGELOG.md
+Keywords: crypto,cryptography,hash,hashing,hmac,password,encryption,argon2,ed25519,security
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: crypto
+Requires-Dist: cryptography>=43.0.0; extra == "crypto"
+Provides-Extra: argon2
+Requires-Dist: argon2-cffi>=23.1.0; extra == "argon2"
+Provides-Extra: bcrypt
+Requires-Dist: bcrypt>=4.0.0; extra == "bcrypt"
+Provides-Extra: full
+Requires-Dist: cryptography>=43.0.0; extra == "full"
+Requires-Dist: argon2-cffi>=23.1.0; extra == "full"
+Requires-Dist: bcrypt>=4.0.0; extra == "full"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
+Requires-Dist: mypy>=1.0.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# Modern Cryptography & Hashing Toolkit (Python)
+
+A misuse-resistant, high-level cryptography library with safe defaults, constant-time verification, and a clear API for hashing, password hashing, key derivation, symmetric encryption, HMAC, and digital signatures.
+
+## Features
+
+- **Safe hashing**: SHA-256, SHA-384, SHA-512, SHA-3, BLAKE2 (MD5 and SHA-1 rejected)
+- **HMAC**: Constant-time verification
+- **Password hashing**: PBKDF2-SHA256, scrypt, Argon2id, bcrypt with adaptive costs
+- **Key derivation**: PBKDF2 and scrypt
+- **Symmetric encryption**: AES-256-GCM or ChaCha20-Poly1305 with automatic nonce management
+- **Digital signatures**: Ed25519
+- **Zero runtime dependencies** for core hashing, HMAC, and key derivation
+- **Optional extras** for AEAD encryption and signatures (`[crypto]`), Argon2id (`[argon2]`), and bcrypt (`[bcrypt]`)
+
+## Installation
+
+```bash
+pip install crypto-toolkit-py
+```
+
+With all optional dependencies:
+
+```bash
+pip install "crypto-toolkit-py[full]"
+```
+
+## Quick Start
+
+```python
+from crypto_toolkit import hash, password, encrypt, sign
+
+# Safe, deterministic hashing
+sha256 = hash.string('hello world', algorithm='sha-256')
+print(sha256)
+
+mac = hash.hmac('secret-key', 'message', algorithm='sha-256')
+assert hash.verify_hmac(mac, 'secret-key', 'message', algorithm='sha-256')
+
+# Password hashing
+ph = password.hash('user-password')
+assert password.verify('user-password', ph)
+
+# Key derivation
+salt = b'16-or-more-random-bytes'
+key = password.derive('passphrase', salt=salt, length=32)
+
+# Symmetric encryption (requires cryptography)
+ciphertext = encrypt.symmetric('sensitive data', key=key)
+plaintext = encrypt.decrypt(ciphertext, key=key)
+assert plaintext == 'sensitive data'
+
+# Digital signatures (requires cryptography)
+private_key, public_key = sign.generate_keypair()
+signature = sign.ed25519('message', private_key=private_key)
+assert sign.verify(signature, 'message', public_key=public_key)
+```
+
+## Development
+
+```bash
+cd implementations/security/crypto-toolkit/python
+pip install -e ".[dev,full]"
+pytest test_crypto_toolkit.py -v
+```
+
+## License
+
+MIT License

crypto_toolkit_py-1.0.0/crypto_toolkit_py.egg-info/SOURCES.txt

@@ -0,0 +1,18 @@
+CHANGELOG.md
+LICENSE
+MANIFEST.in
+README.md
+pyproject.toml
+setup.py
+crypto_toolkit/__init__.py
+crypto_toolkit/encrypt.py
+crypto_toolkit/exceptions.py
+crypto_toolkit/hash.py
+crypto_toolkit/password.py
+crypto_toolkit/py.typed
+crypto_toolkit/sign.py
+crypto_toolkit_py.egg-info/PKG-INFO
+crypto_toolkit_py.egg-info/SOURCES.txt
+crypto_toolkit_py.egg-info/dependency_links.txt
+crypto_toolkit_py.egg-info/requires.txt
+crypto_toolkit_py.egg-info/top_level.txt

crypto_toolkit_py-1.0.0/crypto_toolkit_py.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

crypto_toolkit_py-1.0.0/crypto_toolkit_py.egg-info/requires.txt

@@ -0,0 +1,20 @@
+
+[argon2]
+argon2-cffi>=23.1.0
+
+[bcrypt]
+bcrypt>=4.0.0
+
+[crypto]
+cryptography>=43.0.0
+
+[dev]
+pytest>=7.0.0
+pytest-cov>=4.0.0
+mypy>=1.0.0
+ruff>=0.1.0
+
+[full]
+cryptography>=43.0.0
+argon2-cffi>=23.1.0
+bcrypt>=4.0.0

crypto_toolkit_py-1.0.0/crypto_toolkit_py.egg-info/top_level.txt

@@ -0,0 +1 @@
+crypto_toolkit

crypto_toolkit_py-1.0.0/pyproject.toml

@@ -0,0 +1,85 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "crypto-toolkit-py"
+version = "1.0.0"
+description = "Modern Cryptography & Hashing Toolkit - a misuse-resistant, high-level cryptography library for Python"
+readme = "README.md"
+authors = [
+    {name = "Parthiv Rawat", email = "parthiv05022000@gmail.com"}
+]
+maintainers = [
+    {name = "Parthiv Rawat", email = "parthiv05022000@gmail.com"}
+]
+license = "MIT"
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: Security :: Cryptography",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+keywords = [
+    "crypto",
+    "cryptography",
+    "hash",
+    "hashing",
+    "hmac",
+    "password",
+    "encryption",
+    "argon2",
+    "ed25519",
+    "security",
+]
+requires-python = ">=3.8"
+dependencies = []
+
+[project.optional-dependencies]
+crypto = ["cryptography>=43.0.0"]
+argon2 = ["argon2-cffi>=23.1.0"]
+bcrypt = ["bcrypt>=4.0.0"]
+full = ["cryptography>=43.0.0", "argon2-cffi>=23.1.0", "bcrypt>=4.0.0"]
+dev = [
+    "pytest>=7.0.0",
+    "pytest-cov>=4.0.0",
+    "mypy>=1.0.0",
+    "ruff>=0.1.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/parthivrawat/crypto-toolkit-py"
+Documentation = "https://github.com/parthivrawat/crypto-toolkit-py/tree/main/python#readme"
+Repository = "https://github.com/parthivrawat/crypto-toolkit-py"
+"Bug Tracker" = "https://github.com/parthivrawat/crypto-toolkit-py/issues"
+Changelog = "https://github.com/parthivrawat/crypto-toolkit-py/blob/main/python/CHANGELOG.md"
+
+[tool.setuptools]
+packages = ["crypto_toolkit"]
+include-package-data = true
+
+[tool.setuptools.package-data]
+crypto_toolkit = ["py.typed"]
+
+[tool.pytest.ini_options]
+testpaths = ["test_crypto_toolkit.py"]
+python_files = ["test_*.py"]
+python_classes = ["Test*"]
+python_functions = ["test_*"]
+addopts = "-v"
+
+[tool.mypy]
+python_version = "3.8"
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = false

crypto_toolkit_py-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

crypto_toolkit_py-1.0.0/setup.py

@@ -0,0 +1,10 @@
+"""
+Setup configuration for crypto-toolkit.
+
+This file exists for backward compatibility with older build tools.
+Modern installations should use pyproject.toml.
+"""
+
+from setuptools import setup
+
+setup()