quantumshield-proxy 1.0.0__py3-none-any.whl

quantumshield_proxy/__init__.py

@@ -0,0 +1,8 @@
+"""
+QuantumShield Reverse Proxy
+────────────────────────────
+Post-Quantum Cryptography (ML-KEM-768 / NIST FIPS 203) Reverse Proxy.
+Provides zero-code-change quantum security for web applications.
+"""
+
+__version__ = "1.0.0"

quantumshield_proxy/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    main()

quantumshield_proxy/classical_encryptor.py

@@ -0,0 +1,136 @@
+"""
+classical_encryptor.py
+──────────────────────────────────────────────────────────────────────────────
+RSA-2048 key generation, encryption, and decryption with timing.
+
+This is the QUANTUM-VULNERABLE baseline for comparison with CRYSTALS-Kyber-768.
+RSA security relies on the integer factorization problem — solvable in
+polynomial time by Shor's Algorithm on a sufficiently powerful quantum computer.
+
+Important: RSA-OAEP can only encrypt data smaller than the key size minus
+padding overhead (~190 bytes max for RSA-2048 with OAEP-SHA256).
+In a real hybrid system you would encrypt a symmetric key with RSA, then
+encrypt the actual data with AES. Here we truncate to 190 bytes to keep
+the benchmark focused on RSA timing characteristics.
+──────────────────────────────────────────────────────────────────────────────
+"""
+
+from cryptography.hazmat.primitives.asymmetric import rsa, padding
+from cryptography.hazmat.primitives import hashes
+import time
+
+
+class ClassicalEncryptor:
+    """RSA-2048 encryptor using OAEP-SHA256 padding."""
+
+    def __init__(self):
+        self.private_key = None
+        self.public_key = None
+        self.key_size = 2048
+
+    def generate_keypair(self) -> dict:
+        """
+        Generate a fresh RSA-2048 key pair.
+        Returns key gen time in milliseconds and key size in bits.
+        """
+        start = time.perf_counter()
+        self.private_key = rsa.generate_private_key(
+            public_exponent=65537,
+            key_size=self.key_size,
+        )
+        self.public_key = self.private_key.public_key()
+        elapsed = (time.perf_counter() - start) * 1000
+
+        return {
+            "key_gen_time_ms": round(elapsed, 3),
+            "key_size_bits": self.key_size,
+            "quantum_resistant": False,
+            "quantum_security_bits": 0,
+            "algorithm": "RSA-2048",
+            "padding": "OAEP-SHA256",
+        }
+
+    def encrypt(self, data: bytes) -> dict:
+        """
+        Encrypt data with RSA-OAEP.
+        Truncates input to 190 bytes — the max payload for RSA-2048 + OAEP-SHA256.
+        Returns ciphertext hex, encryption time, and ciphertext size.
+        """
+        if self.public_key is None:
+            raise RuntimeError("Call generate_keypair() before encrypt()")
+
+        # RSA-2048 with OAEP-SHA256: max plaintext = (2048/8) - 2*32 - 2 = 190 bytes
+        data_chunk = data[:190]
+
+        start = time.perf_counter()
+        ciphertext = self.public_key.encrypt(
+            data_chunk,
+            padding.OAEP(
+                mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                algorithm=hashes.SHA256(),
+                label=None,
+            ),
+        )
+        elapsed = (time.perf_counter() - start) * 1000
+
+        return {
+            "ciphertext": ciphertext.hex(),
+            "encryption_time_ms": round(elapsed, 3),
+            "ciphertext_size_bytes": len(ciphertext),
+            "plaintext_size_bytes": len(data_chunk),
+        }
+
+    def decrypt(self, ciphertext_hex: str) -> dict:
+        """
+        Decrypt RSA-OAEP ciphertext.
+        Returns recovered plaintext and decryption time.
+        """
+        if self.private_key is None:
+            raise RuntimeError("Call generate_keypair() before decrypt()")
+
+        start = time.perf_counter()
+        plaintext = self.private_key.decrypt(
+            bytes.fromhex(ciphertext_hex),
+            padding.OAEP(
+                mgf=padding.MGF1(algorithm=hashes.SHA256()),
+                algorithm=hashes.SHA256(),
+                label=None,
+            ),
+        )
+        elapsed = (time.perf_counter() - start) * 1000
+
+        return {
+            "plaintext": plaintext.decode("utf-8", errors="replace"),
+            "decryption_time_ms": round(elapsed, 3),
+        }
+
+
+# ─── Self-test when run directly ──────────────────────────────────────────────
+
+if __name__ == "__main__":
+    enc = ClassicalEncryptor()
+
+    print("🔑 Generating RSA-2048 key pair...")
+    keygen = enc.generate_keypair()
+    print(f"   Key gen time : {keygen['key_gen_time_ms']} ms")
+    print(f"   Key size     : {keygen['key_size_bits']} bits")
+    print(f"   Quantum safe : {keygen['quantum_resistant']}")
+    assert keygen["key_gen_time_ms"] > 0
+    assert keygen["key_size_bits"] == 2048
+
+    test_data = b"UPI|Aarav Sharma->Priya Patel|4500|SBI|2026-01-03T10:15:30Z"
+    print(f"\n🔒 Encrypting: {test_data[:60]}")
+    enc_result = enc.encrypt(test_data)
+    print(f"   Encrypt time     : {enc_result['encryption_time_ms']} ms")
+    print(f"   Ciphertext size  : {enc_result['ciphertext_size_bytes']} bytes")
+    print(f"   Ciphertext (hex) : {enc_result['ciphertext'][:40]}...")
+    assert enc_result["ciphertext_size_bytes"] == 256  # RSA-2048 always 256 bytes
+    assert len(enc_result["ciphertext"]) == 512         # hex = 2 chars per byte
+
+    print(f"\n🔓 Decrypting ciphertext...")
+    dec_result = enc.decrypt(enc_result["ciphertext"])
+    print(f"   Decrypt time  : {dec_result['decryption_time_ms']} ms")
+    print(f"   Recovered     : {dec_result['plaintext'][:60]}")
+    assert dec_result["plaintext"] == test_data[:190].decode("utf-8")
+
+    print("\n✅ M3 complete — RSA-2048 encryptor working correctly")

quantumshield_proxy/cli.py

@@ -0,0 +1,72 @@
+import argparse
+import sys
+import os
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="⚡ QuantumShield Reverse Proxy — Zero-Code-Change Post-Quantum Security (ML-KEM-768)"
+    )
+    parser.add_argument(
+        "--port", "-p",
+        type=int,
+        default=8443,
+        help="Port to run the QuantumShield Reverse Proxy on (default: 8443)"
+    )
+    parser.add_argument(
+        "--upstream", "-u",
+        type=str,
+        default="http://localhost:3001",
+        help="Upstream target application URL (default: http://localhost:3001)"
+    )
+    parser.add_argument(
+        "--mode", "-m",
+        choices=["KYBER_PQC", "RSA_ONLY"],
+        default="KYBER_PQC",
+        help="Protection mode: KYBER_PQC or RSA_ONLY (default: KYBER_PQC)"
+    )
+    args = parser.parse_args()
+
+    # Interactive prompt if executed directly in a TTY terminal without explicit flags
+    if sys.stdin.isatty() and not os.environ.get("NON_INTERACTIVE"):
+        has_upstream_flag = any(a in sys.argv for a in ["--upstream", "-u"])
+        has_port_flag = any(a in sys.argv for a in ["--port", "-p"])
+        has_mode_flag = any(a in sys.argv for a in ["--mode", "-m"])
+
+        if not (has_upstream_flag and has_port_flag and has_mode_flag):
+            print("\n🌐 QuantumShield PQC Reverse Proxy — Setup Wizard")
+            print("─────────────────────────────────────────────────")
+            if not has_upstream_flag:
+                u_in = input(f"Enter target upstream app URL [default: {args.upstream}]: ").strip()
+                if u_in:
+                    args.upstream = u_in
+            if not has_port_flag:
+                p_in = input(f"Enter proxy listening port [default: {args.port}]: ").strip()
+                if p_in and p_in.isdigit():
+                    args.port = int(p_in)
+            if not has_mode_flag:
+                m_in = input("Select initial protection mode ([1] KYBER_PQC (Post-Quantum Safe) / [2] RSA_ONLY) [default: 1]: ").strip()
+                if m_in == "2" or m_in.lower() in ["rsa", "2"]:
+                    args.mode = "RSA_ONLY"
+            print()
+
+    print("=" * 65)
+    print("⚡ QuantumShield PQC Reverse Proxy")
+    print(f"   Listening on: http://0.0.0.0:{args.port}")
+    print(f"   Forwarding to: {args.upstream}")
+    print(f"   Initial Mode: {args.mode}")
+    print("   Standard: NIST FIPS 203 (ML-KEM-768)")
+    print("=" * 65)
+
+    os.environ["PROXY_PORT"] = str(args.port)
+    os.environ["UPSTREAM_URL"] = args.upstream
+    os.environ["PROXY_MODE"] = args.mode
+    if args.mode == "KYBER_PQC":
+        os.environ["PQC_ENABLED"] = "true"
+
+    from .proxy_server import proxy_app, PROXY_STATE
+    PROXY_STATE["mode"] = args.mode
+
+    proxy_app.run(host="0.0.0.0", port=args.port, debug=False)
+
+if __name__ == "__main__":
+    main()

quantumshield_proxy/pqc_encryptor.py

@@ -0,0 +1,169 @@
+"""
+pqc_encryptor.py
+──────────────────────────────────────────────────────────────────────────────
+CRYSTALS-Kyber-768 key generation, encapsulation, and decapsulation via liboqs.
+NIST FIPS 203 — finalized August 2024.
+
+KEY DIFFERENCE FROM RSA (important for viva):
+──────────────────────────────────────────────
+RSA is a direct encryption scheme — you encrypt data directly with the public key.
+
+Kyber is a Key Encapsulation Mechanism (KEM):
+  1. encapsulate()  → produces a random shared secret + a ciphertext
+  2. decapsulate()  → recovers the same shared secret from the ciphertext
+
+The shared secret (32 bytes) is then used as a symmetric key (e.g. AES-256)
+to encrypt the actual data. This is the standard hybrid encryption pattern.
+
+Why KEM instead of direct encryption?
+  - KEMs are more efficient for large data
+  - The security proof is cleaner and stronger
+  - NIST chose KEM-based designs for all PQC key exchange standards
+
+Quantum security basis:
+  - RSA relies on integer factorization → broken by Shor's Algorithm
+  - Kyber relies on Module-LWE (Learning With Errors) lattice problem
+  - No known quantum algorithm solves LWE in polynomial time
+  - Kyber-768 provides 184 bits of quantum security
+──────────────────────────────────────────────────────────────────────────────
+"""
+
+import oqs
+import time
+
+
+class PQCEncryptor:
+    """CRYSTALS-Kyber-768 KEM using liboqs (Open Quantum Safe project)."""
+
+    def __init__(self, algorithm: str = "Kyber768"):
+        self.algorithm = algorithm
+        self.public_key: bytes | None = None
+        self.secret_key: bytes | None = None
+
+    def generate_keypair(self) -> dict:
+        """
+        Generate a Kyber-768 key pair.
+        Returns key gen time, key sizes, algorithm metadata.
+        """
+        start = time.perf_counter()
+        with oqs.KeyEncapsulation(self.algorithm) as kem:
+            self.public_key = kem.generate_keypair()
+            self.secret_key = kem.export_secret_key()
+        elapsed = (time.perf_counter() - start) * 1000
+
+        return {
+            "key_gen_time_ms": round(elapsed, 3),
+            "public_key_size_bytes": len(self.public_key),
+            "secret_key_size_bytes": len(self.secret_key),
+            "algorithm": self.algorithm,
+            "nist_standard": "FIPS 203",
+            "quantum_resistant": True,
+            "quantum_security_bits": 184,
+        }
+
+    def encapsulate(self) -> dict:
+        """
+        Generate a shared secret and its ciphertext using the public key.
+
+        The sender runs this — they get:
+          - ciphertext: sent to the other party (or intercepted by attacker)
+          - shared_secret: used locally as symmetric encryption key
+
+        An attacker who intercepts the ciphertext cannot recover the shared
+        secret without solving the Module-LWE problem.
+        """
+        if self.public_key is None:
+            raise RuntimeError("Call generate_keypair() before encapsulate()")
+
+        start = time.perf_counter()
+        with oqs.KeyEncapsulation(self.algorithm) as kem:
+            ciphertext, shared_secret = kem.encap_secret(self.public_key)
+        elapsed = (time.perf_counter() - start) * 1000
+
+        return {
+            "ciphertext": ciphertext.hex(),
+            "shared_secret": shared_secret.hex(),
+            "encapsulation_time_ms": round(elapsed, 3),
+            "ciphertext_size_bytes": len(ciphertext),
+            "shared_secret_size_bytes": len(shared_secret),
+        }
+
+    def decapsulate(self, ciphertext_hex: str) -> dict:
+        """
+        Recover the shared secret from a ciphertext using the secret key.
+
+        The receiver runs this — they get the same shared_secret the sender
+        computed during encapsulate(), without it ever being transmitted.
+        This is the core security property of a KEM.
+        """
+        if self.secret_key is None:
+            raise RuntimeError("Call generate_keypair() before decapsulate()")
+
+        start = time.perf_counter()
+        with oqs.KeyEncapsulation(self.algorithm, secret_key=self.secret_key) as kem:
+            shared_secret = kem.decap_secret(bytes.fromhex(ciphertext_hex))
+        elapsed = (time.perf_counter() - start) * 1000
+
+        return {
+            "shared_secret": shared_secret.hex(),
+            "decapsulation_time_ms": round(elapsed, 3),
+        }
+
+
+# ─── Self-test when run directly ──────────────────────────────────────────────
+
+if __name__ == "__main__":
+    import os
+    os.environ["LIBOQS_PYTHON_FAULTHANDLER"] = "0"  # suppress the faulthandler info message
+
+    enc = PQCEncryptor()
+
+    print("=" * 60)
+    print("  CRYSTALS-Kyber-768 — Post-Quantum KEM Demo")
+    print("  NIST FIPS 203 | Quantum Security: 184 bits")
+    print("=" * 60)
+
+    print("\n🔑 Step 1: Key Generation")
+    keygen = enc.generate_keypair()
+    print(f"   Algorithm        : {keygen['algorithm']}")
+    print(f"   NIST standard    : {keygen['nist_standard']} (finalized Aug 2024)")
+    print(f"   Key gen time     : {keygen['key_gen_time_ms']} ms")
+    print(f"   Public key size  : {keygen['public_key_size_bytes']} bytes")
+    print(f"   Secret key size  : {keygen['secret_key_size_bytes']} bytes")
+    print(f"   Quantum security : {keygen['quantum_security_bits']} bits ✅")
+    print(f"   Quantum safe     : {keygen['quantum_resistant']} ← Shor's Algorithm CANNOT break this")
+    assert keygen["public_key_size_bytes"] == 1184
+    assert keygen["quantum_resistant"] is True
+
+    print("\n🔒 Step 2: Encapsulation (Sender side)")
+    print("   What happens: sender generates a random shared secret")
+    print("   + a ciphertext that only the receiver can open")
+    encap = enc.encapsulate()
+    print(f"   Encap time          : {encap['encapsulation_time_ms']} ms")
+    print(f"   Ciphertext size     : {encap['ciphertext_size_bytes']} bytes (sent over network)")
+    print(f"   Shared secret (hex) : {encap['shared_secret'][:40]}...")
+    print(f"   Shared secret size  : {encap['shared_secret_size_bytes']} bytes = AES-256 key")
+    print(f"   ⚠️  If attacker intercepts ciphertext → they CANNOT recover shared secret")
+    print(f"   ⚠️  Shor's Algorithm fails — no periodic structure in LWE lattice")
+    assert encap["ciphertext_size_bytes"] == 1088
+
+    print("\n🔓 Step 3: Decapsulation (Receiver side)")
+    print("   What happens: receiver uses secret key to recover the SAME shared secret")
+    print("   The shared secret was NEVER transmitted — only the ciphertext was")
+    decap = enc.decapsulate(encap["ciphertext"])
+    print(f"   Decap time          : {decap['decapsulation_time_ms']} ms")
+    print(f"   Recovered secret    : {decap['shared_secret'][:40]}...")
+
+    match = encap["shared_secret"] == decap["shared_secret"]
+    print(f"\n{'✅' if match else '❌'} Secrets match: {match}")
+    print(f"   → Both parties now share the same 32-byte key")
+    print(f"   → They use it for AES-256 to encrypt actual transaction data")
+    print(f"   → A quantum attacker intercepting the ciphertext gets NOTHING")
+
+    assert match, "Shared secrets do not match — decapsulation failed!"
+
+    print("\n" + "=" * 60)
+    print("  VERDICT: QUANTUM SAFE ✅")
+    print("  RSA-2048 would be broken here. Kyber-768 is not.")
+    print("=" * 60)
+    print("\n✅ M4 complete — CRYSTALS-Kyber-768 encryptor working correctly")

quantumshield_proxy/proxy_server.py

@@ -0,0 +1,378 @@
+"""
+proxy_server.py  —  QuantumShield Reverse Proxy (Port 8443)
+──────────────────────────────────────────────────────────────────────────────
+Architecture:
+  Browser (ShopEasy checkout)
+    │  RSA-encrypted payload (browser pre-encrypted with SubtleCrypto)
+    ▼
+  POST http://localhost:8443/proxy/pay        ← This server
+    │  1. Log intercepted ciphertext to Harvest Vault
+    │  2. If KYBER_PQC mode: also wrap in Kyber-768 KEM envelope
+    │  3. Forward to merchant: http://localhost:3001/api/pay
+    ▼
+  POST http://localhost:3001/api/pay          ← ShopEasy merchant (internal)
+    │  Returns order_id, rsa_config (p, q, N)
+    ▼
+  Proxy returns tx_hash + order_id to browser
+
+Enabling PQC protection (single line):
+  Via /migrate UI:  POST /api/proxy/activate  { "mode": "KYBER_PQC" }
+  Via env var:      PQC_ENABLED=true (read at startup, sets mode)
+
+Disabling:
+  POST /api/proxy/activate  { "mode": "RSA_ONLY" }
+  or  PQC_ENABLED=false  and restart
+──────────────────────────────────────────────────────────────────────────────
+"""
+
+import os
+import time
+import json
+import hashlib
+import urllib.request
+from flask import Flask, request, jsonify
+from flask_cors import CORS
+from .pqc_encryptor import PQCEncryptor
+from .classical_encryptor import ClassicalEncryptor
+
+proxy_app = Flask(__name__)
+CORS(proxy_app, resources={r"/*": {"origins": "*"}})
+
+# ── Proxy state ───────────────────────────────────────────────────────────────
+# mode: "KYBER_PQC"  → wrap RSA ciphertext in Kyber-768, forward (quantum SAFE) [DEFAULT]
+#       "RSA_ONLY"   → log RSA ciphertext, forward as-is (quantum VULNERABLE)
+
+def get_upstream_pay_url():
+    base_url = os.environ.get("UPSTREAM_URL", "http://localhost:3001").rstrip("/")
+    if not base_url.startswith("http://") and not base_url.startswith("https://"):
+        base_url = "http://" + base_url
+    if base_url.endswith("/api/pay"):
+        return base_url
+    return f"{base_url}/api/pay"
+
+
+_initial_mode = "RSA_ONLY" if os.environ.get("PQC_ENABLED", "true").lower() == "false" else "KYBER_PQC"
+
+PROXY_STATE = {
+    "mode": _initial_mode,
+    "active_since": time.strftime("%Y-%m-%d %H:%M:%S"),
+}
+
+print(f"[Proxy] Starting in mode: {PROXY_STATE['mode']}")
+
+HARVEST_VAULT = []     # Stores all intercepted transactions
+INTERCEPTION_LOG = []  # Lightweight log for /api/proxy/log
+
+# ── Crypto engines ────────────────────────────────────────────────────────────
+# ML-KEM-768 = NIST FIPS 203 standard (finalized Aug 2024)
+# This matches what @noble/post-quantum ml_kem768 implements in the browser,
+# so browser encapsulate() ↔ proxy decapsulate() are wire-compatible.
+pqc_engine = PQCEncryptor(algorithm="ML-KEM-768")
+pqc_engine.generate_keypair()
+
+classical_engine = ClassicalEncryptor()
+
+
+# ── XOR decrypt helper (mirrors browser xorEncrypt) ─────────────────────────
+
+def xor_decrypt(hex_str: str, k: int) -> str:
+    """Reverse of browser xorEncrypt(str, k): each byte b XOR ((k*(i+1)) % 256)."""
+    data = bytes.fromhex(hex_str)
+    out  = bytes(b ^ ((k * (i + 1)) % 256) for i, b in enumerate(data))
+    return out.decode("utf-8", errors="replace")
+
+
+def xor_decrypt_with_secret(hex_str: str, secret_hex: str) -> str:
+    """XOR-decrypt payload using Kyber shared secret bytes as repeating key."""
+    data   = bytes.fromhex(hex_str)
+    key    = bytes.fromhex(secret_hex)
+    out    = bytes(b ^ key[i % len(key)] for i, b in enumerate(data))
+    return out.decode("utf-8", errors="replace")
+
+
+# ── Vault helper ──────────────────────────────────────────────────────────────
+
+def add_to_vault(payload: dict, merchant_response: dict, is_pqc: bool) -> dict:
+    tx_id = f"TX-{len(HARVEST_VAULT) + 1001}"
+    raw_str = json.dumps(payload) + json.dumps(merchant_response)
+    tx_hash = "0x" + hashlib.sha256(raw_str.encode()).hexdigest()
+
+    method = payload.get("method", "card")
+    amount = payload.get("amount", 0)
+    payment_summary = payload.get("payment_summary", "")
+    rsa_config = payload.get("rsa_config", merchant_response.get("rsa_config", {}))
+
+    # The actual ciphertext for Shor's to decrypt:
+    #   rsa_encrypted_key    = c = k^e mod N  (RSA-encrypted session key)
+    #   xor_encrypted_payload = payload XOR seed(k)  (the encrypted payment JSON)
+    rsa_encrypted_key = payload.get("rsa_encrypted_key", "")
+    xor_encrypted_payload = payload.get("xor_encrypted_payload", "")
+
+    record = {
+        "id": tx_id,
+        "timestamp": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "merchant": merchant_response.get("merchant", "ShopEasy Store"),
+        "amount": amount,
+        "method": method,
+        "payment_summary": payment_summary,
+        "mode": "KYBER-768 (PQC)" if is_pqc else "RSA-2048 (VULNERABLE)",
+        "status": "PROTECTED" if is_pqc else "EXPOSED",
+        "tx_hash": tx_hash,
+        # raw_payload: everything the attack page needs to run actual decryption
+        "raw_payload": {
+            "rsa_encrypted_key": rsa_encrypted_key,       # c = k^e mod N
+            "xor_encrypted_payload": xor_encrypted_payload,  # XOR ciphertext
+            "rsa_config": rsa_config,
+            "amount": amount,
+            "method": method,
+        },
+        # Kyber ciphertext (populated in KYBER mode)
+        "kyber_ciphertext": payload.get("kyber_ciphertext", ""),
+    }
+
+    HARVEST_VAULT.insert(0, record)
+    INTERCEPTION_LOG.insert(0, {
+        "timestamp": record["timestamp"],
+        "tx_id": tx_id,
+        "mode": record["mode"],
+        "status": record["status"],
+        "amount": f"₹{amount}",
+    })
+
+    if len(HARVEST_VAULT) > 100:
+        HARVEST_VAULT.pop()
+    if len(INTERCEPTION_LOG) > 100:
+        INTERCEPTION_LOG.pop()
+
+    return record
+
+
+# ── Main proxy endpoint ───────────────────────────────────────────────────────
+
+@proxy_app.route("/proxy/pay", methods=["POST", "OPTIONS"])
+def proxy_payment():
+    if request.method == "OPTIONS":
+        return jsonify({"status": "OK"}), 200
+
+    data = request.get_json(force=True)
+    is_pqc = (PROXY_STATE["mode"] == "KYBER_PQC")
+
+    # ── 1. Forward to ShopEasy merchant (3001/api/pay) ────────────────────────
+    # The encrypted_hex was RSA-encrypted by the browser using SubtleCrypto.
+    # We forward it to the merchant so they can assign an order_id and return
+    # the rsa_config.N (which the attack page needs to run Shor's algorithm).
+    forward_body = json.dumps(data).encode("utf-8")
+    merchant_req = urllib.request.Request(
+        get_upstream_pay_url(),
+        data=forward_body,
+        headers={
+            "Content-Type": "application/json",
+            "User-Agent": "QuantumShield-Proxy/1.0",
+        },
+        method="POST",
+    )
+    with urllib.request.urlopen(merchant_req, timeout=5) as resp:
+        merchant_response = json.loads(resp.read().decode("utf-8"))
+
+    # Update rsa_config from merchant (authoritative source)
+    if "rsa_config" in merchant_response:
+        data["rsa_config"] = merchant_response["rsa_config"]
+
+    # ── 2. Log intercepted ciphertext to Harvest Vault ────────────────────────
+    record = add_to_vault(data, merchant_response, is_pqc)
+
+    # ── 3. Apply Kyber-768 wrapper if PQC mode is active ─────────────────────
+    kyber_ciphertext = None
+    if is_pqc:
+        encap_res = pqc_engine.encapsulate()
+        kyber_ciphertext = encap_res.get("ciphertext")
+
+    # ── 4. Return response to browser ─────────────────────────────────────────
+    response_payload = {
+        "status": "SUCCESS",
+        "order_id": merchant_response.get("order_id", record["id"]),
+        "amount": merchant_response.get("amount", data.get("amount")),
+        "merchant": "ShopEasy Store",
+        "pqc_secured": is_pqc and kyber_ciphertext is not None,
+        "mode": record["mode"],
+        "tx_hash": record["tx_hash"],
+        "rsa_config": data.get("rsa_config", {}),
+        "kyber_ciphertext": (kyber_ciphertext[:64] + "...") if kyber_ciphertext else None,
+    }
+
+    return jsonify(response_payload), 200
+
+
+# ── Kyber-encrypted payment endpoint ─────────────────────────────────────────
+
+@proxy_app.route("/api/proxy/pubkey", methods=["GET"])
+def get_kyber_pubkey():
+    """Return the proxy's ML-KEM-768 public key as hex. Browser uses this to encapsulate."""
+    if pqc_engine.public_key is None:
+        return jsonify({"error": "Keypair not generated"}), 500
+    return jsonify({
+        "public_key_hex": pqc_engine.public_key.hex(),
+        "algorithm": pqc_engine.algorithm,   # "ML-KEM-768" — matches @noble/post-quantum ml_kem768
+        "public_key_size_bytes": len(pqc_engine.public_key),
+        "note": "Use this public key with ml_kem768.encapsulate(). Send kyber_ciphertext to /api/proxy/pay/kyber",
+    })
+
+
+@proxy_app.route("/api/proxy/pay/kyber", methods=["POST", "OPTIONS"])
+def proxy_payment_kyber():
+    """
+    Accepts a Kyber-KEM-encrypted payment from the browser.
+
+    Browser sends:
+      {
+        kyber_ciphertext:        <hex>  — KEM ciphertext (encapsulated shared secret)
+        kyber_encrypted_payload: <hex>  — payload XOR-encrypted with shared secret
+        amount:                  <int>
+        method:                  <str>
+        payment_summary:         <str>
+      }
+
+    This proxy:
+      1. Decapsulates kyber_ciphertext with the secret key → recovers shared_secret
+      2. XOR-decrypts kyber_encrypted_payload with shared_secret → plaintext JSON
+      3. Forwards to merchant (3001/api/pay) for order_id
+      4. Stores the Kyber ciphertext (NOT the plaintext) in the vault
+    """
+    if request.method == "OPTIONS":
+        return jsonify({"status": "OK"}), 200
+
+    data = request.get_json(force=True) or {}
+
+    kyber_ct_hex = data.get("kyber_ciphertext", "")
+    kyber_payload_hex = data.get("kyber_encrypted_payload", "")
+
+    # ── 1. Decapsulate to recover shared secret ───────────────────────────────
+    try:
+        decap_result = pqc_engine.decapsulate(kyber_ct_hex)
+        shared_secret_hex = decap_result["shared_secret"]
+    except Exception as ex:
+        return jsonify({"error": f"Kyber decapsulation failed: {ex}"}), 400
+
+    # ── 2. XOR-decrypt the payload with the shared secret ────────────────────
+    try:
+        plaintext = xor_decrypt_with_secret(kyber_payload_hex, shared_secret_hex)
+        payment_data = json.loads(plaintext)
+    except Exception as ex:
+        return jsonify({"error": f"Payload decryption failed: {ex}"}), 400
+
+    # ── 3. Forward to ShopEasy merchant ──────────────────────────────────────
+    forward_body = json.dumps(payment_data).encode("utf-8")
+    try:
+        merchant_req = urllib.request.Request(
+            get_upstream_pay_url(),
+            data=forward_body,
+            headers={"Content-Type": "application/json", "User-Agent": "QuantumShield-Proxy/1.0"},
+            method="POST",
+        )
+        with urllib.request.urlopen(merchant_req, timeout=5) as resp:
+            merchant_response = json.loads(resp.read().decode("utf-8"))
+    except Exception as ex:
+        merchant_response = {"order_id": f"SE-K{len(HARVEST_VAULT)+1001}", "merchant": "ShopEasy Store"}
+
+    # ── 4. Store KYBER ciphertext in vault (not plaintext!) ───────────────────
+    vault_payload = {
+        "amount": data.get("amount", payment_data.get("amount", 0)),
+        "method": data.get("method", payment_data.get("method", "card")),
+        "payment_summary": data.get("payment_summary", ""),
+        "kyber_ciphertext": kyber_ct_hex,          # what Wireshark sees on wire
+        "kyber_encrypted_payload": kyber_payload_hex,
+        # NO rsa_encrypted_key — Shor's has nothing to work with
+        "rsa_encrypted_key": "",
+        "xor_encrypted_payload": "",
+        "rsa_config": {},
+    }
+    record = add_to_vault(vault_payload, merchant_response, is_pqc=True)
+
+    return jsonify({
+        "status": "SUCCESS",
+        "order_id": merchant_response.get("order_id", record["id"]),
+        "amount": vault_payload["amount"],
+        "merchant": "ShopEasy Store",
+        "pqc_secured": True,
+        "mode": "KYBER-768 (PQC)",
+        "tx_hash": record["tx_hash"],
+        "kyber_ciphertext_preview": kyber_ct_hex[:64] + "...",
+    }), 200
+
+
+# ── Control endpoints ─────────────────────────────────────────────────────────
+
+@proxy_app.route("/api/proxy/activate", methods=["POST", "OPTIONS"])
+def activate_proxy():
+    """Toggle protection mode. Called by /migrate UI."""
+    if request.method == "OPTIONS":
+        return jsonify({"status": "OK"}), 200
+
+    body = request.get_json(force=True) or {}
+    mode = body.get("mode", "KYBER_PQC")
+    if mode not in ("RSA_ONLY", "KYBER_PQC"):
+        return jsonify({"status": "ERROR", "message": "mode must be RSA_ONLY or KYBER_PQC"}), 400
+
+    PROXY_STATE["mode"] = mode
+    PROXY_STATE["active_since"] = time.strftime("%Y-%m-%d %H:%M:%S")
+
+    return jsonify({
+        "status": "SUCCESS",
+        "mode": PROXY_STATE["mode"],
+        "active_since": PROXY_STATE["active_since"],
+        "message": f"Proxy switched to {mode}.",
+    })
+
+
+@proxy_app.route("/api/proxy/status", methods=["GET"])
+def proxy_status():
+    return jsonify({
+        "service": "QuantumShield PQC Reverse Proxy",
+        "port": 8443,
+        "mode": PROXY_STATE["mode"],
+        "pqc_active": PROXY_STATE["mode"] == "KYBER_PQC",
+        "harvested_count": len(HARVEST_VAULT),
+        "active_since": PROXY_STATE["active_since"],
+    })
+
+
+@proxy_app.route("/api/proxy/vault", methods=["GET"])
+def get_vault():
+    return jsonify({
+        "total_harvested": len(HARVEST_VAULT),
+        "vault": HARVEST_VAULT,
+    })
+
+
+@proxy_app.route("/api/proxy/log", methods=["GET"])
+def get_log():
+    return jsonify({
+        "mode": PROXY_STATE["mode"],
+        "logs": INTERCEPTION_LOG,
+    })
+
+
+@proxy_app.route("/api/proxy/vault/clear", methods=["POST", "OPTIONS"])
+def clear_vault():
+    """Clear all harvested records — useful before a demo run."""
+    if request.method == "OPTIONS":
+        return jsonify({"status": "OK"}), 200
+    HARVEST_VAULT.clear()
+    INTERCEPTION_LOG.clear()
+    return jsonify({"status": "CLEARED", "message": "Vault and interception log reset."})
+
+
+# ── Entry point ───────────────────────────────────────────────────────────────
+
+if __name__ == "__main__":
+    port = int(os.environ.get("PROXY_PORT", "8443"))
+    upstream = get_upstream_pay_url()
+    print("=" * 65)
+    print("⚡ QuantumShield PQC Reverse Proxy")
+    print(f"   Mode: {PROXY_STATE['mode']}")
+    print(f"   Listening on: http://0.0.0.0:{port}")
+    print(f"   Forwarding to: {upstream}")
+    print("   Standard: NIST FIPS 203 (ML-KEM-768)")
+    print("=" * 65)
+    print()
+    proxy_app.run(host="0.0.0.0", port=port, debug=False)

quantumshield_proxy-1.0.0.dist-info/METADATA

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: quantumshield-proxy
+Version: 1.0.0
+Summary: Zero-code-change Post-Quantum Cryptography (ML-KEM-768 / Kyber) Reverse Proxy
+Author-email: Hemanth <dev@quantumshield.io>
+Project-URL: Homepage, https://github.com/hemanth/Ccp_QuantumShield
+Project-URL: Bug Tracker, https://github.com/hemanth/Ccp_QuantumShield/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: flask>=3.0.0
+Requires-Dist: flask-cors>=4.0.0
+Requires-Dist: liboqs-python>=0.10.0
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: requests>=2.31.0
+
+# QuantumShield — Backend
+
+Python Flask backend for the QuantumShield post-quantum cryptography demo.
+
+## Structure
+
+```
+backend/
+├── app.py                    # Flask entry point — all routes
+├── classical_encryptor.py    # RSA-2048 encrypt/decrypt + timing
+├── pqc_encryptor.py          # CRYSTALS-Kyber-768 via liboqs + timing
+├── quantum_simulator.py      # Shor's Algorithm simulation
+├── benchmark_engine.py       # 1000 transaction benchmarking
+├── vulnerability_scanner.py  # Algorithm risk classification
+├── migration_wizard.py       # 5-step migration plan + PDF export
+├── transaction_factory.py    # Synthetic dataset loader
+├── data/
+│   └── mock_transactions.json  # 1000 synthetic UPI transactions
+├── requirements.txt
+├── .env.example
+└── .gitignore
+```
+
+## Setup
+
+```bash
+pip install -r requirements.txt
+```
+
+## Run
+
+```bash
+python app.py
+# Flask running on http://localhost:5000
+```
+
+## API Endpoints
+
+| Method | Endpoint              | Description                        |
+|--------|-----------------------|------------------------------------|
+| GET    | /api/health           | Health check                       |
+| POST   | /api/encrypt/rsa      | Encrypt with RSA-2048              |
+| POST   | /api/encrypt/kyber    | Encapsulate with Kyber-768         |
+| POST   | /api/gateway/pay      | Full payment gateway simulation    |
+| GET    | /api/attack/rsa       | Shor's attack on RSA               |
+| GET    | /api/attack/kyber     | Shor's attack on Kyber             |
+| GET    | /api/benchmark?n=100  | Run N transaction benchmark        |
+| POST   | /api/scan             | Vulnerability scan an algorithm    |
+| POST   | /api/migrate          | Generate 5-step migration plan     |
+| POST   | /api/report           | Download PDF migration report      |
+
+## Test individually
+
+```bash
+python transaction_factory.py   # M1
+python classical_encryptor.py   # M3
+python pqc_encryptor.py         # M4
+python quantum_simulator.py     # M5
+python vulnerability_scanner.py # M8a
+python migration_wizard.py      # M8b
+python benchmark_engine.py      # M9
+```

quantumshield_proxy-1.0.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+quantumshield_proxy/__init__.py,sha256=8BkCJKv73pUQZijA98t6SkABhunMr8u8xfMH9OHCITA,279
+quantumshield_proxy/__main__.py,sha256=MSmt_5Xg84uHqzTN38JwgseJK8rsJn_11A8WD99VtEo,61
+quantumshield_proxy/classical_encryptor.py,sha256=9gH5fr5Hr3Tk5e8ZT5PtrML7x1PifJpaJcVvQfW8JBQ,5606
+quantumshield_proxy/cli.py,sha256=rDOb04VyHwkvY2IL9MFD62K6vjC6k81_1w3pFkcMWI4,2910
+quantumshield_proxy/pqc_encryptor.py,sha256=DFCE-VtsBsN5FQIkAoP7eCWVBF12FuOpx6eWaGQTCgA,7852
+quantumshield_proxy/proxy_server.py,sha256=FbPxokDegbt1tE1wyiON5H8pwOdKbge4oh4Ztj_qKtQ,16277
+quantumshield_proxy-1.0.0.dist-info/METADATA,sha256=0brXcaZT9RD3NH1vOevg6s07nE3hYaup6velKpoeaiI,2928
+quantumshield_proxy-1.0.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+quantumshield_proxy-1.0.0.dist-info/entry_points.txt,sha256=BTkgS7J1SA86KDcp9VJ2MdKUOIlrxx6HDIwfwVU5fLs,69
+quantumshield_proxy-1.0.0.dist-info/top_level.txt,sha256=YP8Z5S5N7XUkZ4opIkRgwtqmjy4ePL7_BGdOMOtvEUI,20
+quantumshield_proxy-1.0.0.dist-info/RECORD,,

quantumshield_proxy-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

quantumshield_proxy-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+quantumshield-proxy = quantumshield_proxy.cli:main

quantumshield_proxy-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+quantumshield_proxy