ztop 1.1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (62) hide show
  1. ztop-1.1.0/LICENSE +21 -0
  2. ztop-1.1.0/PKG-INFO +266 -0
  3. ztop-1.1.0/README.md +186 -0
  4. ztop-1.1.0/pyproject.toml +131 -0
  5. ztop-1.1.0/setup.cfg +4 -0
  6. ztop-1.1.0/tests/test_advanced.py +491 -0
  7. ztop-1.1.0/tests/test_engines.py +320 -0
  8. ztop-1.1.0/tests/test_integration.py +126 -0
  9. ztop-1.1.0/tests/test_packet.py +177 -0
  10. ztop-1.1.0/tests/test_states.py +122 -0
  11. ztop-1.1.0/ztop/__init__.py +84 -0
  12. ztop-1.1.0/ztop/__main__.py +8 -0
  13. ztop-1.1.0/ztop/_version.py +3 -0
  14. ztop-1.1.0/ztop/api/__init__.py +4 -0
  15. ztop-1.1.0/ztop/api/management.py +302 -0
  16. ztop-1.1.0/ztop/cli.py +590 -0
  17. ztop-1.1.0/ztop/core/__init__.py +1 -0
  18. ztop-1.1.0/ztop/core/session.py +262 -0
  19. ztop-1.1.0/ztop/dashboard/__init__.py +5 -0
  20. ztop-1.1.0/ztop/dashboard/api.py +562 -0
  21. ztop-1.1.0/ztop/dashboard/events.py +104 -0
  22. ztop-1.1.0/ztop/engines/__init__.py +1 -0
  23. ztop-1.1.0/ztop/engines/audit_engine.py +245 -0
  24. ztop-1.1.0/ztop/engines/cem_engine.py +269 -0
  25. ztop-1.1.0/ztop/engines/cert_engine.py +194 -0
  26. ztop-1.1.0/ztop/engines/cert_store.py +62 -0
  27. ztop-1.1.0/ztop/engines/cert_transfer.py +70 -0
  28. ztop-1.1.0/ztop/engines/execution_analyzer.py +525 -0
  29. ztop-1.1.0/ztop/engines/heartbeat_engine.py +305 -0
  30. ztop-1.1.0/ztop/engines/integrity_engine.py +161 -0
  31. ztop-1.1.0/ztop/engines/kex_engine.py +158 -0
  32. ztop-1.1.0/ztop/engines/merkle_engine.py +287 -0
  33. ztop-1.1.0/ztop/engines/metadata_engine.py +275 -0
  34. ztop-1.1.0/ztop/engines/peer_id_engine.py +211 -0
  35. ztop-1.1.0/ztop/engines/policy_engine.py +229 -0
  36. ztop-1.1.0/ztop/engines/pqc_engine.py +291 -0
  37. ztop-1.1.0/ztop/engines/reconnect_engine.py +254 -0
  38. ztop-1.1.0/ztop/engines/signature_chain.py +246 -0
  39. ztop-1.1.0/ztop/engines/tamper_engine.py +177 -0
  40. ztop-1.1.0/ztop/engines/trust_engine.py +190 -0
  41. ztop-1.1.0/ztop/engines/yara_rules/ztop_default.yar +87 -0
  42. ztop-1.1.0/ztop/network/__init__.py +1 -0
  43. ztop-1.1.0/ztop/network/client.py +524 -0
  44. ztop-1.1.0/ztop/network/quic_client.py +157 -0
  45. ztop-1.1.0/ztop/network/quic_server.py +208 -0
  46. ztop-1.1.0/ztop/network/server.py +905 -0
  47. ztop-1.1.0/ztop/network/tls.py +262 -0
  48. ztop-1.1.0/ztop/protocol/__init__.py +3 -0
  49. ztop-1.1.0/ztop/protocol/constants.py +122 -0
  50. ztop-1.1.0/ztop/protocol/errors.py +81 -0
  51. ztop-1.1.0/ztop/protocol/messages.py +103 -0
  52. ztop-1.1.0/ztop/protocol/packet.py +364 -0
  53. ztop-1.1.0/ztop/protocol/states.py +87 -0
  54. ztop-1.1.0/ztop/py.typed +1 -0
  55. ztop-1.1.0/ztop/storage/__init__.py +4 -0
  56. ztop-1.1.0/ztop/storage/sqlite_store.py +396 -0
  57. ztop-1.1.0/ztop.egg-info/PKG-INFO +266 -0
  58. ztop-1.1.0/ztop.egg-info/SOURCES.txt +60 -0
  59. ztop-1.1.0/ztop.egg-info/dependency_links.txt +1 -0
  60. ztop-1.1.0/ztop.egg-info/entry_points.txt +2 -0
  61. ztop-1.1.0/ztop.egg-info/requires.txt +36 -0
  62. ztop-1.1.0/ztop.egg-info/top_level.txt +1 -0
ztop-1.1.0/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 ZTOP Research Group, Zero Trust Consortium
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
ztop-1.1.0/PKG-INFO ADDED
@@ -0,0 +1,266 @@
1
+ Metadata-Version: 2.4
2
+ Name: ztop
3
+ Version: 1.1.0
4
+ Summary: Zero Trust Transfer Orchestration Protocol -- RFC reference implementation (v1.1.0, 8 Advanced Upgrades)
5
+ Author-email: ZTOP Research Group <ztop@zero-trust-consortium.org>
6
+ License: MIT License
7
+
8
+ Copyright (c) 2026 ZTOP Research Group, Zero Trust Consortium
9
+
10
+ Permission is hereby granted, free of charge, to any person obtaining a copy
11
+ of this software and associated documentation files (the "Software"), to deal
12
+ in the Software without restriction, including without limitation the rights
13
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14
+ copies of the Software, and to permit persons to whom the Software is
15
+ furnished to do so, subject to the following conditions:
16
+
17
+ The above copyright notice and this permission notice shall be included in all
18
+ copies or substantial portions of the Software.
19
+
20
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
23
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
26
+ SOFTWARE.
27
+
28
+ Project-URL: Homepage, https://github.com/sripad2020/ztop-research
29
+ Project-URL: Documentation, https://github.com/sripad2020/ztop-research#readme
30
+ Project-URL: Repository, https://github.com/sripad2020/ztop-research
31
+ Project-URL: Bug Tracker, https://github.com/sripad2020/ztop-research/issues
32
+ Project-URL: Changelog, https://github.com/sripad2020/ztop-research/blob/main/CHANGELOG.md
33
+ Keywords: zero-trust,file-transfer,protocol,cryptography,security
34
+ Classifier: Development Status :: 4 - Beta
35
+ Classifier: Environment :: Console
36
+ Classifier: Intended Audience :: Developers
37
+ Classifier: Intended Audience :: System Administrators
38
+ Classifier: License :: OSI Approved :: MIT License
39
+ Classifier: Operating System :: OS Independent
40
+ Classifier: Programming Language :: Python :: 3
41
+ Classifier: Programming Language :: Python :: 3.11
42
+ Classifier: Programming Language :: Python :: 3.12
43
+ Classifier: Programming Language :: Python :: 3.13
44
+ Classifier: Topic :: Internet
45
+ Classifier: Topic :: Security :: Cryptography
46
+ Classifier: Topic :: System :: Networking
47
+ Classifier: Typing :: Typed
48
+ Requires-Python: >=3.11
49
+ Description-Content-Type: text/markdown
50
+ License-File: LICENSE
51
+ Requires-Dist: cryptography>=41.0
52
+ Requires-Dist: click>=8.1
53
+ Provides-Extra: dev
54
+ Requires-Dist: pytest>=8.0; extra == "dev"
55
+ Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
56
+ Requires-Dist: ruff>=0.4; extra == "dev"
57
+ Requires-Dist: mypy>=1.10; extra == "dev"
58
+ Requires-Dist: build>=1.2; extra == "dev"
59
+ Requires-Dist: twine>=5.0; extra == "dev"
60
+ Provides-Extra: pqc
61
+ Requires-Dist: oqs-python>=0.9.0; extra == "pqc"
62
+ Provides-Extra: quic
63
+ Requires-Dist: aioquic>=0.9.25; extra == "quic"
64
+ Provides-Extra: dashboard
65
+ Requires-Dist: fastapi>=0.111; extra == "dashboard"
66
+ Requires-Dist: uvicorn[standard]>=0.30; extra == "dashboard"
67
+ Provides-Extra: grpc
68
+ Requires-Dist: grpcio>=1.64; extra == "grpc"
69
+ Requires-Dist: grpcio-tools>=1.64; extra == "grpc"
70
+ Requires-Dist: protobuf>=5.0; extra == "grpc"
71
+ Provides-Extra: storage
72
+ Requires-Dist: aiosqlite>=0.20; extra == "storage"
73
+ Provides-Extra: analysis
74
+ Requires-Dist: yara-python>=4.5; extra == "analysis"
75
+ Requires-Dist: scikit-learn>=1.5; extra == "analysis"
76
+ Requires-Dist: numpy>=1.26; extra == "analysis"
77
+ Provides-Extra: full
78
+ Requires-Dist: ztop[analysis,dashboard,grpc,pqc,quic,storage]; extra == "full"
79
+ Dynamic: license-file
80
+
81
+ # ZTOP — Zero Trust Transfer Orchestration Protocol
82
+
83
+ [![PyPI version](https://img.shields.io/pypi/v/ztop.svg)](https://pypi.org/project/ztop/)
84
+ [![Python](https://img.shields.io/pypi/pyversions/ztop.svg)](https://pypi.org/project/ztop/)
85
+ [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
86
+
87
+ ZTOP is a Python reference implementation of the **Zero Trust Transfer Orchestration Protocol**, an Application Layer (OSI Layer 7) protocol for cryptographically authenticated, continuously attested peer-to-peer file transfer in Zero Trust Architectures (ZTA).
88
+
89
+ ---
90
+
91
+ ## Overview
92
+
93
+ Traditional file transfer protocols (SFTP, FTP) authenticate once and establish a trusted channel. ZTOP integrates every Zero Trust principle natively into the protocol itself:
94
+
95
+ | Feature | Description |
96
+ |---|---|
97
+ | Cryptographic Peer Identity | HKDF-SHA512 + Ed25519 derived from hardware device UUID |
98
+ | Continuous Attestation | 16-field Heartbeat with 8 validation checks every 10 seconds |
99
+ | 5-Layer Certificate Chain | Root CA, Org CA, Device, Session, Transfer Receipt — X.509 P384 |
100
+ | Trust Scoring | 100-point composite posture score with 7-factor evaluation |
101
+ | Policy Engine | 6 independent checks before any transfer is authorized |
102
+ | Merkle Tree Integrity | Per-chunk SHA-256 verification with proof ascent |
103
+ | Cryptographic Execution Manifest | 380-byte signed CEM prepended to every transferred file |
104
+ | Pre-Execution Static Analysis | Entropy, PE/ELF/Python behavioral analysis before delivery |
105
+ | 7-Level Signature Chain | All 7 Ed25519 signatures required for SYNC_COMPLETE |
106
+ | Trust-Preserving Reconnection | Resumes from last verified chunk after disconnect |
107
+ | Real ECDSA-P384 Audit Records | Gateway seals every transfer with real P384 signatures |
108
+
109
+ ---
110
+
111
+ ## Installation
112
+
113
+ ```bash
114
+ pip install ztop
115
+ ```
116
+
117
+ Requires Python 3.11 or later.
118
+
119
+ ### Development installation
120
+
121
+ ```bash
122
+ git clone https://github.com/sripad2020/ztop-research
123
+ cd ztop-research
124
+ pip install -e ".[dev]"
125
+ ```
126
+
127
+ ---
128
+
129
+ ## Quick Start
130
+
131
+ ### Start a gateway server
132
+
133
+ ```bash
134
+ ztop server
135
+ # or with custom address
136
+ ztop server --host 0.0.0.0 --port 7890 --log-level DEBUG
137
+ ```
138
+
139
+ ### Connect and upload a file
140
+
141
+ ```bash
142
+ ztop client --file /path/to/document.pdf
143
+ # or specify target
144
+ ztop client --host 10.0.0.5 --port 7890 --file /path/to/file --device-id my-laptop --org-id acme-corp
145
+ ```
146
+
147
+ ### Run the self-contained demo (no setup required)
148
+
149
+ ```bash
150
+ ztop demo
151
+ ```
152
+
153
+ ### Run the advanced X.509 certificate demo
154
+
155
+ ```bash
156
+ ztop cert-demo
157
+ ```
158
+
159
+ ### Check version
160
+
161
+ ```bash
162
+ ztop version
163
+ ```
164
+
165
+ ---
166
+
167
+ ## Session Lifecycle
168
+
169
+ ```
170
+ Client Gateway
171
+ | |
172
+ |-------- HELLO ----------------> | Phase 1: Discovery
173
+ |<------- DISCOVER --------------- |
174
+ |-------- REGISTER -------------> | Phase 2: Identity
175
+ |<------- IDENTITY_REQUEST ------- | Ed25519 challenge issued
176
+ |-------- IDENTITY_RESPONSE ----> | 64-byte sig + 32-byte pubkey
177
+ |-------- TRUST_REQUEST --------> | Phase 3: Device Posture
178
+ |<------- TRUST_RESPONSE --------- | Score assigned
179
+ |-------- POLICY_REQUEST -------> | Phase 4: Policy Evaluation
180
+ |<------- POLICY_RESPONSE -------- | 6-check authorization
181
+ |-------- CAPABILITY_NEGOTIATE -> | Phase 5: Negotiation
182
+ |<------- CAPABILITY_NEGOTIATE --- | chunk_size, window
183
+ |-------- SESSION_CREATE -------> | Phase 6: Session Active
184
+ |<------- SESSION_ACCEPT --------- |
185
+ |-------- TRANSFER_REQUEST -----> | Phase 7: File Transfer
186
+ |<------- TRANSFER_START --------- |
187
+ |-------- TRANSFER_CHUNK x N ---> | PAYLOAD_ENCRYPTED required
188
+ |<------- TRANSFER_ACK ----------- | per-chunk Merkle verification
189
+ |-------- TRANSFER_COMPLETE ----> | Phase 8: Audit
190
+ |<------- INTEGRITY_VERIFY ------- | SHA-3-512 file check
191
+ |<------- AUDIT_COMMIT ----------- | ECDSA-P384 sealed record
192
+ |-------- SESSION_CLOSE --------> | Phase 9: Graceful Close
193
+ |<------- SESSION_CLOSE ---------- |
194
+ ```
195
+
196
+ ---
197
+
198
+ ## Architecture
199
+
200
+ ```
201
+ ztop/
202
+ protocol/ Binary wire format (packet.py, states.py, messages.py)
203
+ core/ Session state management (session.py)
204
+ engines/
205
+ trust_engine.py Device posture scoring (100-point scale)
206
+ policy_engine.py 6-check transfer authorization
207
+ heartbeat_engine.py Continuous 8-check attestation
208
+ merkle_engine.py Binary SHA-256 Merkle tree
209
+ cem_engine.py Cryptographic Execution Manifest
210
+ audit_engine.py ECDSA-P384 audit record sealing
211
+ cert_engine.py X.509 5-layer certificate hierarchy
212
+ signature_chain.py 7-level Ed25519 signature chain
213
+ peer_id_engine.py HKDF hardware-derived Peer ID
214
+ integrity_engine.py Per-chunk and file-level hash verification
215
+ tamper_engine.py Adaptive Tamper Resistance Score (TRS)
216
+ execution_analyzer.py Pre-execution static behavioral analysis
217
+ reconnect_engine.py Trust-preserving session resumption
218
+ metadata_engine.py 19-field dual-signed metadata exchange
219
+ network/
220
+ server.py asyncio TCP gateway server
221
+ client.py asyncio client agent
222
+ cli.py click-based command-line interface
223
+ ```
224
+
225
+ ---
226
+
227
+ ## Security Notes
228
+
229
+ - **Transport**: ZTOP is designed to run inside a TLS 1.3 tunnel. The reference implementation uses plain TCP for development convenience. For production use, place behind a TLS terminator or enable TLS in the network layer.
230
+ - **HMAC Keys**: The current implementation does not perform a key exchange during the handshake. Both sides use an unshared key by default, so HMAC validation is not enforced. A full ECDH-based key exchange is planned for v1.1.
231
+ - **Post-Quantum**: Ed25519 and ECDSA-P384 are not quantum-resistant. Future versions will incorporate NIST-standardized post-quantum algorithms.
232
+
233
+ See [SECURITY.md](SECURITY.md) for the full threat model and responsible disclosure policy.
234
+
235
+ ---
236
+
237
+ ## Running Tests
238
+
239
+ ```bash
240
+ pip install -e ".[dev]"
241
+ pytest tests/ -v --tb=short
242
+ ```
243
+
244
+ ---
245
+
246
+ ## Building for PyPI
247
+
248
+ ```bash
249
+ python -m build
250
+ twine check dist/*
251
+ twine upload dist/*
252
+ ```
253
+
254
+ ---
255
+
256
+ ## IETF Reference
257
+
258
+ This implementation targets **draft-ztop-secdispatch-protocol-00**, submitted to the IETF SECDISPATCH working group.
259
+
260
+ Internet-Draft: [https://datatracker.ietf.org/drafts/current/](https://datatracker.ietf.org/drafts/current/)
261
+
262
+ ---
263
+
264
+ ## License
265
+
266
+ MIT — see [LICENSE](LICENSE).
ztop-1.1.0/README.md ADDED
@@ -0,0 +1,186 @@
1
+ # ZTOP — Zero Trust Transfer Orchestration Protocol
2
+
3
+ [![PyPI version](https://img.shields.io/pypi/v/ztop.svg)](https://pypi.org/project/ztop/)
4
+ [![Python](https://img.shields.io/pypi/pyversions/ztop.svg)](https://pypi.org/project/ztop/)
5
+ [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
6
+
7
+ ZTOP is a Python reference implementation of the **Zero Trust Transfer Orchestration Protocol**, an Application Layer (OSI Layer 7) protocol for cryptographically authenticated, continuously attested peer-to-peer file transfer in Zero Trust Architectures (ZTA).
8
+
9
+ ---
10
+
11
+ ## Overview
12
+
13
+ Traditional file transfer protocols (SFTP, FTP) authenticate once and establish a trusted channel. ZTOP integrates every Zero Trust principle natively into the protocol itself:
14
+
15
+ | Feature | Description |
16
+ |---|---|
17
+ | Cryptographic Peer Identity | HKDF-SHA512 + Ed25519 derived from hardware device UUID |
18
+ | Continuous Attestation | 16-field Heartbeat with 8 validation checks every 10 seconds |
19
+ | 5-Layer Certificate Chain | Root CA, Org CA, Device, Session, Transfer Receipt — X.509 P384 |
20
+ | Trust Scoring | 100-point composite posture score with 7-factor evaluation |
21
+ | Policy Engine | 6 independent checks before any transfer is authorized |
22
+ | Merkle Tree Integrity | Per-chunk SHA-256 verification with proof ascent |
23
+ | Cryptographic Execution Manifest | 380-byte signed CEM prepended to every transferred file |
24
+ | Pre-Execution Static Analysis | Entropy, PE/ELF/Python behavioral analysis before delivery |
25
+ | 7-Level Signature Chain | All 7 Ed25519 signatures required for SYNC_COMPLETE |
26
+ | Trust-Preserving Reconnection | Resumes from last verified chunk after disconnect |
27
+ | Real ECDSA-P384 Audit Records | Gateway seals every transfer with real P384 signatures |
28
+
29
+ ---
30
+
31
+ ## Installation
32
+
33
+ ```bash
34
+ pip install ztop
35
+ ```
36
+
37
+ Requires Python 3.11 or later.
38
+
39
+ ### Development installation
40
+
41
+ ```bash
42
+ git clone https://github.com/sripad2020/ztop-research
43
+ cd ztop-research
44
+ pip install -e ".[dev]"
45
+ ```
46
+
47
+ ---
48
+
49
+ ## Quick Start
50
+
51
+ ### Start a gateway server
52
+
53
+ ```bash
54
+ ztop server
55
+ # or with custom address
56
+ ztop server --host 0.0.0.0 --port 7890 --log-level DEBUG
57
+ ```
58
+
59
+ ### Connect and upload a file
60
+
61
+ ```bash
62
+ ztop client --file /path/to/document.pdf
63
+ # or specify target
64
+ ztop client --host 10.0.0.5 --port 7890 --file /path/to/file --device-id my-laptop --org-id acme-corp
65
+ ```
66
+
67
+ ### Run the self-contained demo (no setup required)
68
+
69
+ ```bash
70
+ ztop demo
71
+ ```
72
+
73
+ ### Run the advanced X.509 certificate demo
74
+
75
+ ```bash
76
+ ztop cert-demo
77
+ ```
78
+
79
+ ### Check version
80
+
81
+ ```bash
82
+ ztop version
83
+ ```
84
+
85
+ ---
86
+
87
+ ## Session Lifecycle
88
+
89
+ ```
90
+ Client Gateway
91
+ | |
92
+ |-------- HELLO ----------------> | Phase 1: Discovery
93
+ |<------- DISCOVER --------------- |
94
+ |-------- REGISTER -------------> | Phase 2: Identity
95
+ |<------- IDENTITY_REQUEST ------- | Ed25519 challenge issued
96
+ |-------- IDENTITY_RESPONSE ----> | 64-byte sig + 32-byte pubkey
97
+ |-------- TRUST_REQUEST --------> | Phase 3: Device Posture
98
+ |<------- TRUST_RESPONSE --------- | Score assigned
99
+ |-------- POLICY_REQUEST -------> | Phase 4: Policy Evaluation
100
+ |<------- POLICY_RESPONSE -------- | 6-check authorization
101
+ |-------- CAPABILITY_NEGOTIATE -> | Phase 5: Negotiation
102
+ |<------- CAPABILITY_NEGOTIATE --- | chunk_size, window
103
+ |-------- SESSION_CREATE -------> | Phase 6: Session Active
104
+ |<------- SESSION_ACCEPT --------- |
105
+ |-------- TRANSFER_REQUEST -----> | Phase 7: File Transfer
106
+ |<------- TRANSFER_START --------- |
107
+ |-------- TRANSFER_CHUNK x N ---> | PAYLOAD_ENCRYPTED required
108
+ |<------- TRANSFER_ACK ----------- | per-chunk Merkle verification
109
+ |-------- TRANSFER_COMPLETE ----> | Phase 8: Audit
110
+ |<------- INTEGRITY_VERIFY ------- | SHA-3-512 file check
111
+ |<------- AUDIT_COMMIT ----------- | ECDSA-P384 sealed record
112
+ |-------- SESSION_CLOSE --------> | Phase 9: Graceful Close
113
+ |<------- SESSION_CLOSE ---------- |
114
+ ```
115
+
116
+ ---
117
+
118
+ ## Architecture
119
+
120
+ ```
121
+ ztop/
122
+ protocol/ Binary wire format (packet.py, states.py, messages.py)
123
+ core/ Session state management (session.py)
124
+ engines/
125
+ trust_engine.py Device posture scoring (100-point scale)
126
+ policy_engine.py 6-check transfer authorization
127
+ heartbeat_engine.py Continuous 8-check attestation
128
+ merkle_engine.py Binary SHA-256 Merkle tree
129
+ cem_engine.py Cryptographic Execution Manifest
130
+ audit_engine.py ECDSA-P384 audit record sealing
131
+ cert_engine.py X.509 5-layer certificate hierarchy
132
+ signature_chain.py 7-level Ed25519 signature chain
133
+ peer_id_engine.py HKDF hardware-derived Peer ID
134
+ integrity_engine.py Per-chunk and file-level hash verification
135
+ tamper_engine.py Adaptive Tamper Resistance Score (TRS)
136
+ execution_analyzer.py Pre-execution static behavioral analysis
137
+ reconnect_engine.py Trust-preserving session resumption
138
+ metadata_engine.py 19-field dual-signed metadata exchange
139
+ network/
140
+ server.py asyncio TCP gateway server
141
+ client.py asyncio client agent
142
+ cli.py click-based command-line interface
143
+ ```
144
+
145
+ ---
146
+
147
+ ## Security Notes
148
+
149
+ - **Transport**: ZTOP is designed to run inside a TLS 1.3 tunnel. The reference implementation uses plain TCP for development convenience. For production use, place behind a TLS terminator or enable TLS in the network layer.
150
+ - **HMAC Keys**: The current implementation does not perform a key exchange during the handshake. Both sides use an unshared key by default, so HMAC validation is not enforced. A full ECDH-based key exchange is planned for v1.1.
151
+ - **Post-Quantum**: Ed25519 and ECDSA-P384 are not quantum-resistant. Future versions will incorporate NIST-standardized post-quantum algorithms.
152
+
153
+ See [SECURITY.md](SECURITY.md) for the full threat model and responsible disclosure policy.
154
+
155
+ ---
156
+
157
+ ## Running Tests
158
+
159
+ ```bash
160
+ pip install -e ".[dev]"
161
+ pytest tests/ -v --tb=short
162
+ ```
163
+
164
+ ---
165
+
166
+ ## Building for PyPI
167
+
168
+ ```bash
169
+ python -m build
170
+ twine check dist/*
171
+ twine upload dist/*
172
+ ```
173
+
174
+ ---
175
+
176
+ ## IETF Reference
177
+
178
+ This implementation targets **draft-ztop-secdispatch-protocol-00**, submitted to the IETF SECDISPATCH working group.
179
+
180
+ Internet-Draft: [https://datatracker.ietf.org/drafts/current/](https://datatracker.ietf.org/drafts/current/)
181
+
182
+ ---
183
+
184
+ ## License
185
+
186
+ MIT — see [LICENSE](LICENSE).
@@ -0,0 +1,131 @@
1
+ [build-system]
2
+ requires = ["setuptools>=68", "wheel"]
3
+ build-backend = "setuptools.build_meta"
4
+
5
+ [project]
6
+ name = "ztop"
7
+ dynamic = ["version"]
8
+ description = "Zero Trust Transfer Orchestration Protocol -- RFC reference implementation (v1.1.0, 8 Advanced Upgrades)"
9
+ readme = "README.md"
10
+ license = { file = "LICENSE" }
11
+ authors = [{ name = "ZTOP Research Group", email = "ztop@zero-trust-consortium.org" }]
12
+ keywords = ["zero-trust", "file-transfer", "protocol", "cryptography", "security"]
13
+ classifiers = [
14
+ "Development Status :: 4 - Beta",
15
+ "Environment :: Console",
16
+ "Intended Audience :: Developers",
17
+ "Intended Audience :: System Administrators",
18
+ "License :: OSI Approved :: MIT License",
19
+ "Operating System :: OS Independent",
20
+ "Programming Language :: Python :: 3",
21
+ "Programming Language :: Python :: 3.11",
22
+ "Programming Language :: Python :: 3.12",
23
+ "Programming Language :: Python :: 3.13",
24
+ "Topic :: Internet",
25
+ "Topic :: Security :: Cryptography",
26
+ "Topic :: System :: Networking",
27
+ "Typing :: Typed",
28
+ ]
29
+ requires-python = ">=3.11"
30
+ dependencies = [
31
+ "cryptography>=41.0",
32
+ "click>=8.1",
33
+ ]
34
+
35
+ [project.optional-dependencies]
36
+ dev = [
37
+ "pytest>=8.0",
38
+ "pytest-asyncio>=0.23",
39
+ "ruff>=0.4",
40
+ "mypy>=1.10",
41
+ "build>=1.2",
42
+ "twine>=5.0",
43
+ ]
44
+
45
+ # Area 2 -- TLS 1.3 (stdlib ssl, no extra deps needed)
46
+
47
+ # Area 3 -- Post-Quantum ML-DSA (Dilithium / NIST FIPS 204)
48
+ pqc = [
49
+ "oqs-python>=0.9.0",
50
+ ]
51
+
52
+ # Area 4 -- QUIC transport
53
+ quic = [
54
+ "aioquic>=0.9.25",
55
+ ]
56
+
57
+ # Area 5 -- Real-Time SOC Dashboard
58
+ dashboard = [
59
+ "fastapi>=0.111",
60
+ "uvicorn[standard]>=0.30",
61
+ ]
62
+
63
+ # Area 6 -- gRPC Management API
64
+ grpc = [
65
+ "grpcio>=1.64",
66
+ "grpcio-tools>=1.64",
67
+ "protobuf>=5.0",
68
+ ]
69
+
70
+ # Area 7 -- Persistent Audit Store
71
+ storage = [
72
+ "aiosqlite>=0.20",
73
+ ]
74
+
75
+ # Area 8 -- Advanced Execution Analysis
76
+ analysis = [
77
+ "yara-python>=4.5",
78
+ "scikit-learn>=1.5",
79
+ "numpy>=1.26",
80
+ ]
81
+
82
+ # Install everything
83
+ full = [
84
+ "ztop[pqc,quic,dashboard,grpc,storage,analysis]",
85
+ ]
86
+
87
+ [project.scripts]
88
+ ztop = "ztop.__main__:main"
89
+
90
+ [project.urls]
91
+ Homepage = "https://github.com/sripad2020/ztop-research"
92
+ Documentation = "https://github.com/sripad2020/ztop-research#readme"
93
+ Repository = "https://github.com/sripad2020/ztop-research"
94
+ "Bug Tracker" = "https://github.com/sripad2020/ztop-research/issues"
95
+ Changelog = "https://github.com/sripad2020/ztop-research/blob/main/CHANGELOG.md"
96
+
97
+ [tool.setuptools.dynamic]
98
+ version = { attr = "ztop._version.__version__" }
99
+
100
+ [tool.setuptools.packages.find]
101
+ where = ["."]
102
+ include = ["ztop*"]
103
+
104
+ [tool.setuptools.package-data]
105
+ ztop = [
106
+ "py.typed",
107
+ "engines/yara_rules/*.yar",
108
+ "engines/yara_rules/*.yara",
109
+ ]
110
+
111
+ # ── Ruff (linting + formatting) ──────────────────────────────────────────────
112
+ [tool.ruff]
113
+ target-version = "py311"
114
+ line-length = 100
115
+
116
+ [tool.ruff.lint]
117
+ select = ["E", "F", "W", "I", "UP", "S", "B"]
118
+ ignore = ["S101", "S311"] # allow assert in tests, non-crypto random is fine where noted
119
+
120
+ # ── MyPy ─────────────────────────────────────────────────────────────────────
121
+ [tool.mypy]
122
+ python_version = "3.11"
123
+ strict = false
124
+ ignore_missing_imports = true
125
+
126
+ # ── Pytest ────────────────────────────────────────────────────────────────────
127
+ [tool.pytest.ini_options]
128
+ asyncio_mode = "auto"
129
+ testpaths = ["tests"]
130
+ log_cli = true
131
+ log_cli_level = "WARNING"
ztop-1.1.0/setup.cfg ADDED
@@ -0,0 +1,4 @@
1
+ [egg_info]
2
+ tag_build =
3
+ tag_date = 0
4
+