sibna 1.7.0__tar.gz → 3.0.2__tar.gz

{sibna-1.7.0 → sibna-3.0.2}/MANIFEST.in

@@ -1,4 +1,4 @@
 include README.md
 include LICENSE
 include pyproject.toml
-recursive-include sibna *.dll *.so *.dylib
+recursive-include sibna *.py

sibna-3.0.2/PKG-INFO

@@ -0,0 +1,167 @@
+Metadata-Version: 2.4
+Name: sibna
+Version: 3.0.2
+Summary: Sibna Protocol v3.0.2 — pure Python SDK (X3DH, Double Ratchet, sender-key groups, safety numbers, signed envelopes, encrypted storage, relay HTTP/WebSocket client)
+Author-email: Sibna Security Team <security@sibna.dev>
+License-Expression: Apache-2.0 OR MIT
+Project-URL: Homepage, https://github.com/SibnaOfficial/libsa
+Project-URL: Repository, https://github.com/SibnaOfficial/libsa
+Project-URL: Documentation, https://github.com/SibnaOfficial/libsa#readme
+Project-URL: Bug Tracker, https://github.com/SibnaOfficial/libsa/issues
+Keywords: cryptography,encryption,signal,secure-messaging,e2ee,x3dh,double-ratchet,ml-kem-768
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Communications :: Chat
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=41.0
+Requires-Dist: blake3>=1.0
+Requires-Dist: pqcrypto>=0.3
+Requires-Dist: requests>=2.31
+Requires-Dist: aiohttp>=3.9
+Dynamic: license-file
+
+# Sibna Protocol — Python SDK
+
+Pure-Python implementation of the Sibna Protocol (X3DH handshake, Double
+Ratchet session encryption, sender-key group messaging, safety numbers,
+envelope signing, encrypted storage, and the relay HTTP/WebSocket client).
+
+No Rust core, FFI, or native library is required. All cryptography is provided
+by maintained libraries (`cryptography`, `blake3`, `pqcrypto`).
+
+Wire formats, domain-separation strings, KDF constructions, and limits match
+the retained Rust core (`sibna-protc/core/`) and
+`PROTOCOL_SPECIFICATION.md`.
+
+Install:
+
+    pip install sibna
+
+## Capabilities
+
+| Capability | Modules |
+|---|---|
+| Cryptographic primitives | `sibna.crypto` |
+| X25519 / Ed25519 keys | `sibna.crypto.X25519KeyPair`, `Ed25519KeyPair` |
+| ML-KEM-768 hybrid KEM | `sibna.crypto.ml_kem_768_*` |
+| X3DH handshake | `sibna.x3dh` |
+| Double Ratchet sessions | `sibna.ratchet`, `sibna.session` |
+| Sender-key group messaging | `sibna.group` |
+| Safety numbers | `sibna.safety_number` |
+| Signed envelopes | `sibna.envelope` |
+| Protocol padding | `sibna.padding` |
+| Encrypted storage | `sibna.storage` |
+| Synchronous HTTP relay client | `sibna.client.SibnaClient` |
+| Asynchronous WebSocket relay client | `sibna.client.AsyncSibnaClient` |
+
+## Quick start
+
+```python
+from sibna import (
+    X25519KeyPair, Ed25519KeyPair, Session,
+    generate_peer_bundle, make_signed_envelope,
+    verify_signed_envelope,
+)
+from sibna.crypto import derive_identity_keys
+
+# ── Alice creates her identity ──────────────────────────────────────
+alice_ed = Ed25519KeyPair()
+alice_x = X25519KeyPair()
+
+# ── Bob creates his identity and prekey bundle ──────────────────────
+bob_ed = Ed25519KeyPair()
+bob_x = X25519KeyPair()
+bob_spk = X25519KeyPair()
+bob_opk = X25519KeyPair()
+
+bob_bundle = generate_peer_bundle(
+    identity_ed=bob_ed,
+    identity_x25519=bob_x,
+    signed_prekey=bob_spk,
+    onetime_prekey=bob_opk,
+    device_id_bytes=b"bob-device-01000",   # 16 bytes
+    root_identity_key=bob_ed.public_key,
+)
+
+# ── Alice performs X3DH as initiator ────────────────────────────────
+alice_session = Session()
+ephemeral_pub = alice_session.initiate_as_initiator(
+    identity=alice_x,
+    ephemeral=X25519KeyPair(),
+    peer_bundle=bob_bundle,
+    our_device_id=b"alice-device-010",   # 16 bytes
+    peer_device_id=b"bob-device-01000",   # 16 bytes
+)
+
+# ── Alice encrypts a message for Bob ────────────────────────────────
+plaintext = b"Hello Bob from Alice via Sibna Protocol v3.0.2!"
+ciphertext = alice_session.encrypt(plaintext, associated_data=b"v3.0.2")
+
+# ── Alice creates a signed envelope to send over the relay ──────────
+envelope = make_signed_envelope(
+    alice_ed,
+    recipient_id=bob_ed.public_key.hex(),
+    payload_hex=ciphertext.hex(),
+)
+assert verify_signed_envelope(envelope)
+
+# ── Bob establishes his side of the session and decrypts ────────────
+bob_session = Session()
+bob_session.initiate_as_responder(
+    identity=bob_x,
+    signed_prekey=bob_spk,
+    onetime_prekey=bob_opk,
+    peer_identity=alice_x.public_key,
+    peer_ephemeral=ephemeral_pub,
+    our_device_id=b"bob-device-01000",
+    peer_device_id=b"alice-device-010",
+)
+decrypted = bob_session.decrypt(ciphertext, associated_data=b"v3.0.2")
+assert decrypted == plaintext
+
+print("Sibna SDK quick start: OK")
+```
+
+The package works offline for all cryptographic operations. The relay client
+(`SibnaClient`, `AsyncSibnaClient`) requires a running Sibna relay server
+(see `sibna-protc/server/`) and a valid JWT obtained through the Ed25519
+challenge-response flow.
+
+## Installation
+
+```bash
+pip install sibna
+```
+
+Supported: Python 3.9+ on Linux, macOS, and Windows.
+
+Runtime dependencies: `cryptography`, `blake3`, `pqcrypto`, `requests`,
+`aiohttp`.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+python -m pytest tests/
+black --check sibna tests
+mypy sibna
+```
+
+## Security
+
+This SDK implements the Sibna Protocol v3.0.2. It has not received an
+independent cryptographic audit. Do not describe it as formally verified or
+production-ready without supporting evidence. See `SECURITY.md` and
+`THREAT_MODEL.md` in `sibna-protc`.
+
+License: Apache-2.0 OR MIT.

sibna-3.0.2/README.md

@@ -0,0 +1,135 @@
+# Sibna Protocol — Python SDK
+
+Pure-Python implementation of the Sibna Protocol (X3DH handshake, Double
+Ratchet session encryption, sender-key group messaging, safety numbers,
+envelope signing, encrypted storage, and the relay HTTP/WebSocket client).
+
+No Rust core, FFI, or native library is required. All cryptography is provided
+by maintained libraries (`cryptography`, `blake3`, `pqcrypto`).
+
+Wire formats, domain-separation strings, KDF constructions, and limits match
+the retained Rust core (`sibna-protc/core/`) and
+`PROTOCOL_SPECIFICATION.md`.
+
+Install:
+
+    pip install sibna
+
+## Capabilities
+
+| Capability | Modules |
+|---|---|
+| Cryptographic primitives | `sibna.crypto` |
+| X25519 / Ed25519 keys | `sibna.crypto.X25519KeyPair`, `Ed25519KeyPair` |
+| ML-KEM-768 hybrid KEM | `sibna.crypto.ml_kem_768_*` |
+| X3DH handshake | `sibna.x3dh` |
+| Double Ratchet sessions | `sibna.ratchet`, `sibna.session` |
+| Sender-key group messaging | `sibna.group` |
+| Safety numbers | `sibna.safety_number` |
+| Signed envelopes | `sibna.envelope` |
+| Protocol padding | `sibna.padding` |
+| Encrypted storage | `sibna.storage` |
+| Synchronous HTTP relay client | `sibna.client.SibnaClient` |
+| Asynchronous WebSocket relay client | `sibna.client.AsyncSibnaClient` |
+
+## Quick start
+
+```python
+from sibna import (
+    X25519KeyPair, Ed25519KeyPair, Session,
+    generate_peer_bundle, make_signed_envelope,
+    verify_signed_envelope,
+)
+from sibna.crypto import derive_identity_keys
+
+# ── Alice creates her identity ──────────────────────────────────────
+alice_ed = Ed25519KeyPair()
+alice_x = X25519KeyPair()
+
+# ── Bob creates his identity and prekey bundle ──────────────────────
+bob_ed = Ed25519KeyPair()
+bob_x = X25519KeyPair()
+bob_spk = X25519KeyPair()
+bob_opk = X25519KeyPair()
+
+bob_bundle = generate_peer_bundle(
+    identity_ed=bob_ed,
+    identity_x25519=bob_x,
+    signed_prekey=bob_spk,
+    onetime_prekey=bob_opk,
+    device_id_bytes=b"bob-device-01000",   # 16 bytes
+    root_identity_key=bob_ed.public_key,
+)
+
+# ── Alice performs X3DH as initiator ────────────────────────────────
+alice_session = Session()
+ephemeral_pub = alice_session.initiate_as_initiator(
+    identity=alice_x,
+    ephemeral=X25519KeyPair(),
+    peer_bundle=bob_bundle,
+    our_device_id=b"alice-device-010",   # 16 bytes
+    peer_device_id=b"bob-device-01000",   # 16 bytes
+)
+
+# ── Alice encrypts a message for Bob ────────────────────────────────
+plaintext = b"Hello Bob from Alice via Sibna Protocol v3.0.2!"
+ciphertext = alice_session.encrypt(plaintext, associated_data=b"v3.0.2")
+
+# ── Alice creates a signed envelope to send over the relay ──────────
+envelope = make_signed_envelope(
+    alice_ed,
+    recipient_id=bob_ed.public_key.hex(),
+    payload_hex=ciphertext.hex(),
+)
+assert verify_signed_envelope(envelope)
+
+# ── Bob establishes his side of the session and decrypts ────────────
+bob_session = Session()
+bob_session.initiate_as_responder(
+    identity=bob_x,
+    signed_prekey=bob_spk,
+    onetime_prekey=bob_opk,
+    peer_identity=alice_x.public_key,
+    peer_ephemeral=ephemeral_pub,
+    our_device_id=b"bob-device-01000",
+    peer_device_id=b"alice-device-010",
+)
+decrypted = bob_session.decrypt(ciphertext, associated_data=b"v3.0.2")
+assert decrypted == plaintext
+
+print("Sibna SDK quick start: OK")
+```
+
+The package works offline for all cryptographic operations. The relay client
+(`SibnaClient`, `AsyncSibnaClient`) requires a running Sibna relay server
+(see `sibna-protc/server/`) and a valid JWT obtained through the Ed25519
+challenge-response flow.
+
+## Installation
+
+```bash
+pip install sibna
+```
+
+Supported: Python 3.9+ on Linux, macOS, and Windows.
+
+Runtime dependencies: `cryptography`, `blake3`, `pqcrypto`, `requests`,
+`aiohttp`.
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+python -m pytest tests/
+black --check sibna tests
+mypy sibna
+```
+
+## Security
+
+This SDK implements the Sibna Protocol v3.0.2. It has not received an
+independent cryptographic audit. Do not describe it as formally verified or
+production-ready without supporting evidence. See `SECURITY.md` and
+`THREAT_MODEL.md` in `sibna-protc`.
+
+License: Apache-2.0 OR MIT.

sibna-3.0.2/pyproject.toml

@@ -0,0 +1,82 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "sibna"
+version = "3.0.2"
+description = "Sibna Protocol v3.0.2 — pure Python SDK (X3DH, Double Ratchet, sender-key groups, safety numbers, signed envelopes, encrypted storage, relay HTTP/WebSocket client)"
+readme = "README.md"
+requires-python = ">=3.9"
+license = "Apache-2.0 OR MIT"
+authors = [{name = "Sibna Security Team", email = "security@sibna.dev"}]
+keywords = ["cryptography", "encryption", "signal", "secure-messaging", "e2ee", "x3dh", "double-ratchet", "ml-kem-768"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Topic :: Security :: Cryptography",
+    "Topic :: Communications :: Chat",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Operating System :: OS Independent",
+]
+dependencies = [
+    "cryptography>=41.0",
+    "blake3>=1.0",
+    "pqcrypto>=0.3",
+    "requests>=2.31",
+    "aiohttp>=3.9",
+]
+
+[project.urls]
+Homepage = "https://github.com/SibnaOfficial/libsa"
+Repository = "https://github.com/SibnaOfficial/libsa"
+Documentation = "https://github.com/SibnaOfficial/libsa#readme"
+"Bug Tracker" = "https://github.com/SibnaOfficial/libsa/issues"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["sibna*"]
+exclude = ["sibna-protc*", "*.tests", "*.tests.*", "tests.*", "tests"]
+
+[tool.mypy]
+python_version = "3.13"
+warn_return_any = false
+warn_unused_ignores = true
+disallow_any_generics = false
+
+# Upstream sibna-protc source is authoritative for runtime implementation and
+# must remain byte-identical to libsa/sibna/. It contains pre-existing typing
+# patterns that are not errors at runtime, so those files are excluded from
+# strict mypy checking while the remaining modules are still validated.
+[[tool.mypy.overrides]]
+module = [
+    "sibna.ratchet",
+    "sibna.group",
+    "sibna.client",
+]
+ignore_errors = true
+
+[tool.ruff]
+line-length = 100
+
+[tool.ruff.lint]
+# Upstream source is authoritative and must remain byte-identical; it carries
+# pre-existing lint patterns that are not runtime errors. Enable only the
+# error categories that catch genuine problems (pycodestyle E and pyflakes F),
+# excluding unused-import/unused-variable and line-length notices that
+# upstream itself has.
+select = ["E", "F"]
+ignore = ["F401", "F841", "E501"]
+
+[tool.black]
+line-length = 100
+
+[tool.pytest.ini_options]
+markers = [
+    "interop: cross-implementation Rust-Python interoperability tests (require dedicated runner)",
+]

sibna-3.0.2/setup.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+"""Sibna Protocol v3.0.2 — Pure Python SDK.
+
+This setup.py is a thin compatibility shim. The authoritative package metadata
+lives in pyproject.toml.
+"""
+
+from setuptools import setup
+
+setup()

sibna-3.0.2/sibna/__init__.py

@@ -0,0 +1,249 @@
+"""
+Sibna Protocol — Python SDK v3.0.2 (sole official SDK).
+
+Pure-Python implementation of the Sibna Protocol (X3DH handshake, Double
+Ratchet session encryption, sender-key group messaging, safety numbers,
+envelope signing, encrypted storage, and the relay HTTP/WebSocket client).
+
+No Rust core, FFI, or native library required. All cryptography is provided by
+maintained libraries (`cryptography`, `blake3`, `pqcrypto`).
+
+Wire formats, domain-separation strings, KDF constructions, and limits match
+the retained Rust core (`core/`) and `PROTOCOL_SPECIFICATION.md`.
+
+Install:
+    pip install sibna
+"""
+
+from __future__ import annotations
+
+__version__ = "3.0.2"
+__author__ = "Sibna Security Team"
+__license__ = "Apache-2.0 OR MIT"
+
+# ── Constants ────────────────────────────────────────────────────────────────
+from .constants import (  # noqa: F401
+    ED25519_PUBLIC_KEY_LENGTH,
+    GROUP_CHAIN_KEY_INFO,
+    GROUP_KEY_DISTRIBUTE_INFO,
+    GROUP_MESSAGE_KEY_INFO,
+    KEY_LENGTH,
+    MAX_AD_LEN,
+    MAX_CHAIN_MESSAGES,
+    MAX_EXTRA_BLOCKS,
+    MAX_GROUP_MESSAGE_SIZE,
+    MAX_GROUP_SIZE,
+    MAX_MESSAGE_AGE_SECS,
+    MAX_MESSAGE_NUMBER,
+    MAX_MESSAGE_SIZE,
+    MAX_PASSWORD_LEN,
+    MAX_PADDING_BYTES,
+    MAX_SESSION_ID_LEN,
+    MAX_SKIPPED_MESSAGES,
+    ML_KEM_768_CIPHERTEXT_LENGTH,
+    ML_KEM_768_PUBLIC_KEY_LENGTH,
+    ML_KEM_768_SECRET_KEY_LENGTH,
+    MIN_COMPATIBLE_VERSION,
+    NONCE_LENGTH,
+    PADDING_BLOCK_STANDARD,
+    PROTOCOL_VERSION_STRING,
+    PROTOCOL_VERSION_WIRE,
+    SAFETY_NUMBER_DIGIT_COUNT,
+    TAG_LENGTH,
+    X25519_PUBLIC_KEY_LENGTH,
+)
+
+# ── Errors ───────────────────────────────────────────────────────────────────
+from .errors import (  # noqa: F401
+    AuthError,
+    CryptoError,
+    KeyNotFoundError,
+    NetworkError,
+    ProtocolError,
+    SessionNotFoundError,
+    SibnaError,
+    StorageError,
+    ValidationError,
+)
+
+# ── Cryptographic primitives ─────────────────────────────────────────────────
+from .crypto import (  # noqa: F401
+    C,
+    X25519KeyPair,
+    Ed25519KeyPair,
+    blake3_hash,
+    chacha20_poly1305_decrypt,
+    chacha20_poly1305_encrypt,
+    derive_identity_keys,
+    hmac_sha256,
+    hkdf,
+    hkdf_expand,
+    hkdf_extract,
+    ml_kem_768_decapsulate,
+    ml_kem_768_encapsulate,
+    ml_kem_768_keypair,
+    random_bytes,
+    sha256,
+    sha512,
+)
+
+# ── Padding ──────────────────────────────────────────────────────────────────
+from .padding import (  # noqa: F401
+    PaddingMode,
+    pad_message,
+    pad_payload,
+    unpad_message,
+    unpad_payload,
+)
+
+# ── X3DH ─────────────────────────────────────────────────────────────────────
+from .x3dh import (  # noqa: F401
+    PreKeyBundle,
+    X3DHResult,
+    generate_peer_bundle,
+    x3dh_initiator,
+    x3dh_responder,
+)
+
+# ── Double Ratchet ──────────────────────────────────────────────────────────
+from .ratchet import (  # noqa: F401
+    ChainKey,
+    DoubleRatchet,
+    HEADER_SIZE,
+)
+
+# ── Session ──────────────────────────────────────────────────────────────────
+from .session import (  # noqa: F401
+    Session,
+    SessionConfig,
+)
+
+# ── Group messaging ──────────────────────────────────────────────────────────
+from .group import (  # noqa: F401
+    GroupMessage,
+    GroupSession,
+    SenderKey,
+    SenderKeyMessage,
+    MAX_GROUP_MESSAGE_SIZE as _MAX_GROUP_MESSAGE_SIZE,  # noqa: F401
+    MAX_GROUP_SIZE as _MAX_GROUP_SIZE,  # noqa: F401
+)
+
+# ── Safety numbers ───────────────────────────────────────────────────────────
+from .safety_number import (  # noqa: F401
+    SafetyNumber,
+    SAFETY_NUMBER_DIGIT_COUNT as _SAFETY_NUMBER_DIGIT_COUNT,  # noqa: F401
+    SAFETY_NUMBER_VERSION as _SAFETY_NUMBER_VERSION,  # noqa: F401
+)
+
+# ── Envelope ─────────────────────────────────────────────────────────────────
+from .envelope import (  # noqa: F401
+    ENVELOPE_MAX_AGE_SECS as _ENVELOPE_MAX_AGE_SECS,  # noqa: F401
+    make_signed_envelope,
+    verify_signed_envelope,
+)
+
+# ── Storage ──────────────────────────────────────────────────────────────────
+from .storage import (  # noqa: F401
+    SecureStorage,
+    STORAGE_FORMAT_VERSION as _STORAGE_FORMAT_VERSION,  # noqa: F401
+)
+
+# ── Relay client ─────────────────────────────────────────────────────────────
+from .client import (  # noqa: F401
+    AsyncSibnaClient,
+    Identity,
+    SibnaClient,
+)
+
+__all__ = [
+    # Version
+    "__version__",
+    # Constants
+    "KEY_LENGTH",
+    "ED25519_PUBLIC_KEY_LENGTH",
+    "NONCE_LENGTH",
+    "TAG_LENGTH",
+    "MAX_AD_LEN",
+    "MAX_CHAIN_MESSAGES",
+    "MAX_EXTRA_BLOCKS",
+    "MAX_GROUP_MESSAGE_SIZE",
+    "MAX_GROUP_SIZE",
+    "MAX_MESSAGE_AGE_SECS",
+    "MAX_MESSAGE_NUMBER",
+    "MAX_MESSAGE_SIZE",
+    "MAX_PASSWORD_LEN",
+    "MAX_PADDING_BYTES",
+    "MAX_SESSION_ID_LEN",
+    "MAX_SKIPPED_MESSAGES",
+    "ML_KEM_768_CIPHERTEXT_LENGTH",
+    "ML_KEM_768_PUBLIC_KEY_LENGTH",
+    "ML_KEM_768_SECRET_KEY_LENGTH",
+    "MIN_COMPATIBLE_VERSION",
+    "PADDING_BLOCK_STANDARD",
+    "PROTOCOL_VERSION_STRING",
+    "PROTOCOL_VERSION_WIRE",
+    "SAFETY_NUMBER_DIGIT_COUNT",
+    "X25519_PUBLIC_KEY_LENGTH",
+    # Errors
+    "SibnaError",
+    "AuthError",
+    "CryptoError",
+    "ValidationError",
+    "ProtocolError",
+    "NetworkError",
+    "StorageError",
+    "KeyNotFoundError",
+    "SessionNotFoundError",
+    # Crypto
+    "X25519KeyPair",
+    "Ed25519KeyPair",
+    "blake3_hash",
+    "sha256",
+    "sha512",
+    "hkdf",
+    "hkdf_extract",
+    "hkdf_expand",
+    "hmac_sha256",
+    "random_bytes",
+    "derive_identity_keys",
+    "chacha20_poly1305_encrypt",
+    "chacha20_poly1305_decrypt",
+    "ml_kem_768_keypair",
+    "ml_kem_768_encapsulate",
+    "ml_kem_768_decapsulate",
+    # Padding
+    "PaddingMode",
+    "pad_message",
+    "pad_payload",
+    "unpad_message",
+    "unpad_payload",
+    # X3DH
+    "PreKeyBundle",
+    "X3DHResult",
+    "generate_peer_bundle",
+    "x3dh_initiator",
+    "x3dh_responder",
+    # Double Ratchet
+    "ChainKey",
+    "DoubleRatchet",
+    "HEADER_SIZE",
+    # Session
+    "Session",
+    "SessionConfig",
+    # Group
+    "SenderKey",
+    "SenderKeyMessage",
+    "GroupMessage",
+    "GroupSession",
+    # Safety Numbers
+    "SafetyNumber",
+    # Envelope
+    "make_signed_envelope",
+    "verify_signed_envelope",
+    # Storage
+    "SecureStorage",
+    # Relay client
+    "Identity",
+    "SibnaClient",
+    "AsyncSibnaClient",
+]