ztop 1.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- ztop-1.1.0/LICENSE +21 -0
- ztop-1.1.0/PKG-INFO +266 -0
- ztop-1.1.0/README.md +186 -0
- ztop-1.1.0/pyproject.toml +131 -0
- ztop-1.1.0/setup.cfg +4 -0
- ztop-1.1.0/tests/test_advanced.py +491 -0
- ztop-1.1.0/tests/test_engines.py +320 -0
- ztop-1.1.0/tests/test_integration.py +126 -0
- ztop-1.1.0/tests/test_packet.py +177 -0
- ztop-1.1.0/tests/test_states.py +122 -0
- ztop-1.1.0/ztop/__init__.py +84 -0
- ztop-1.1.0/ztop/__main__.py +8 -0
- ztop-1.1.0/ztop/_version.py +3 -0
- ztop-1.1.0/ztop/api/__init__.py +4 -0
- ztop-1.1.0/ztop/api/management.py +302 -0
- ztop-1.1.0/ztop/cli.py +590 -0
- ztop-1.1.0/ztop/core/__init__.py +1 -0
- ztop-1.1.0/ztop/core/session.py +262 -0
- ztop-1.1.0/ztop/dashboard/__init__.py +5 -0
- ztop-1.1.0/ztop/dashboard/api.py +562 -0
- ztop-1.1.0/ztop/dashboard/events.py +104 -0
- ztop-1.1.0/ztop/engines/__init__.py +1 -0
- ztop-1.1.0/ztop/engines/audit_engine.py +245 -0
- ztop-1.1.0/ztop/engines/cem_engine.py +269 -0
- ztop-1.1.0/ztop/engines/cert_engine.py +194 -0
- ztop-1.1.0/ztop/engines/cert_store.py +62 -0
- ztop-1.1.0/ztop/engines/cert_transfer.py +70 -0
- ztop-1.1.0/ztop/engines/execution_analyzer.py +525 -0
- ztop-1.1.0/ztop/engines/heartbeat_engine.py +305 -0
- ztop-1.1.0/ztop/engines/integrity_engine.py +161 -0
- ztop-1.1.0/ztop/engines/kex_engine.py +158 -0
- ztop-1.1.0/ztop/engines/merkle_engine.py +287 -0
- ztop-1.1.0/ztop/engines/metadata_engine.py +275 -0
- ztop-1.1.0/ztop/engines/peer_id_engine.py +211 -0
- ztop-1.1.0/ztop/engines/policy_engine.py +229 -0
- ztop-1.1.0/ztop/engines/pqc_engine.py +291 -0
- ztop-1.1.0/ztop/engines/reconnect_engine.py +254 -0
- ztop-1.1.0/ztop/engines/signature_chain.py +246 -0
- ztop-1.1.0/ztop/engines/tamper_engine.py +177 -0
- ztop-1.1.0/ztop/engines/trust_engine.py +190 -0
- ztop-1.1.0/ztop/engines/yara_rules/ztop_default.yar +87 -0
- ztop-1.1.0/ztop/network/__init__.py +1 -0
- ztop-1.1.0/ztop/network/client.py +524 -0
- ztop-1.1.0/ztop/network/quic_client.py +157 -0
- ztop-1.1.0/ztop/network/quic_server.py +208 -0
- ztop-1.1.0/ztop/network/server.py +905 -0
- ztop-1.1.0/ztop/network/tls.py +262 -0
- ztop-1.1.0/ztop/protocol/__init__.py +3 -0
- ztop-1.1.0/ztop/protocol/constants.py +122 -0
- ztop-1.1.0/ztop/protocol/errors.py +81 -0
- ztop-1.1.0/ztop/protocol/messages.py +103 -0
- ztop-1.1.0/ztop/protocol/packet.py +364 -0
- ztop-1.1.0/ztop/protocol/states.py +87 -0
- ztop-1.1.0/ztop/py.typed +1 -0
- ztop-1.1.0/ztop/storage/__init__.py +4 -0
- ztop-1.1.0/ztop/storage/sqlite_store.py +396 -0
- ztop-1.1.0/ztop.egg-info/PKG-INFO +266 -0
- ztop-1.1.0/ztop.egg-info/SOURCES.txt +60 -0
- ztop-1.1.0/ztop.egg-info/dependency_links.txt +1 -0
- ztop-1.1.0/ztop.egg-info/entry_points.txt +2 -0
- ztop-1.1.0/ztop.egg-info/requires.txt +36 -0
- ztop-1.1.0/ztop.egg-info/top_level.txt +1 -0
ztop-1.1.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 ZTOP Research Group, Zero Trust Consortium
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
ztop-1.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,266 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: ztop
|
|
3
|
+
Version: 1.1.0
|
|
4
|
+
Summary: Zero Trust Transfer Orchestration Protocol -- RFC reference implementation (v1.1.0, 8 Advanced Upgrades)
|
|
5
|
+
Author-email: ZTOP Research Group <ztop@zero-trust-consortium.org>
|
|
6
|
+
License: MIT License
|
|
7
|
+
|
|
8
|
+
Copyright (c) 2026 ZTOP Research Group, Zero Trust Consortium
|
|
9
|
+
|
|
10
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
11
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
12
|
+
in the Software without restriction, including without limitation the rights
|
|
13
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
14
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
15
|
+
furnished to do so, subject to the following conditions:
|
|
16
|
+
|
|
17
|
+
The above copyright notice and this permission notice shall be included in all
|
|
18
|
+
copies or substantial portions of the Software.
|
|
19
|
+
|
|
20
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
21
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
22
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
23
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
24
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
25
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
26
|
+
SOFTWARE.
|
|
27
|
+
|
|
28
|
+
Project-URL: Homepage, https://github.com/sripad2020/ztop-research
|
|
29
|
+
Project-URL: Documentation, https://github.com/sripad2020/ztop-research#readme
|
|
30
|
+
Project-URL: Repository, https://github.com/sripad2020/ztop-research
|
|
31
|
+
Project-URL: Bug Tracker, https://github.com/sripad2020/ztop-research/issues
|
|
32
|
+
Project-URL: Changelog, https://github.com/sripad2020/ztop-research/blob/main/CHANGELOG.md
|
|
33
|
+
Keywords: zero-trust,file-transfer,protocol,cryptography,security
|
|
34
|
+
Classifier: Development Status :: 4 - Beta
|
|
35
|
+
Classifier: Environment :: Console
|
|
36
|
+
Classifier: Intended Audience :: Developers
|
|
37
|
+
Classifier: Intended Audience :: System Administrators
|
|
38
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
39
|
+
Classifier: Operating System :: OS Independent
|
|
40
|
+
Classifier: Programming Language :: Python :: 3
|
|
41
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
42
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
43
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
44
|
+
Classifier: Topic :: Internet
|
|
45
|
+
Classifier: Topic :: Security :: Cryptography
|
|
46
|
+
Classifier: Topic :: System :: Networking
|
|
47
|
+
Classifier: Typing :: Typed
|
|
48
|
+
Requires-Python: >=3.11
|
|
49
|
+
Description-Content-Type: text/markdown
|
|
50
|
+
License-File: LICENSE
|
|
51
|
+
Requires-Dist: cryptography>=41.0
|
|
52
|
+
Requires-Dist: click>=8.1
|
|
53
|
+
Provides-Extra: dev
|
|
54
|
+
Requires-Dist: pytest>=8.0; extra == "dev"
|
|
55
|
+
Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
|
|
56
|
+
Requires-Dist: ruff>=0.4; extra == "dev"
|
|
57
|
+
Requires-Dist: mypy>=1.10; extra == "dev"
|
|
58
|
+
Requires-Dist: build>=1.2; extra == "dev"
|
|
59
|
+
Requires-Dist: twine>=5.0; extra == "dev"
|
|
60
|
+
Provides-Extra: pqc
|
|
61
|
+
Requires-Dist: oqs-python>=0.9.0; extra == "pqc"
|
|
62
|
+
Provides-Extra: quic
|
|
63
|
+
Requires-Dist: aioquic>=0.9.25; extra == "quic"
|
|
64
|
+
Provides-Extra: dashboard
|
|
65
|
+
Requires-Dist: fastapi>=0.111; extra == "dashboard"
|
|
66
|
+
Requires-Dist: uvicorn[standard]>=0.30; extra == "dashboard"
|
|
67
|
+
Provides-Extra: grpc
|
|
68
|
+
Requires-Dist: grpcio>=1.64; extra == "grpc"
|
|
69
|
+
Requires-Dist: grpcio-tools>=1.64; extra == "grpc"
|
|
70
|
+
Requires-Dist: protobuf>=5.0; extra == "grpc"
|
|
71
|
+
Provides-Extra: storage
|
|
72
|
+
Requires-Dist: aiosqlite>=0.20; extra == "storage"
|
|
73
|
+
Provides-Extra: analysis
|
|
74
|
+
Requires-Dist: yara-python>=4.5; extra == "analysis"
|
|
75
|
+
Requires-Dist: scikit-learn>=1.5; extra == "analysis"
|
|
76
|
+
Requires-Dist: numpy>=1.26; extra == "analysis"
|
|
77
|
+
Provides-Extra: full
|
|
78
|
+
Requires-Dist: ztop[analysis,dashboard,grpc,pqc,quic,storage]; extra == "full"
|
|
79
|
+
Dynamic: license-file
|
|
80
|
+
|
|
81
|
+
# ZTOP — Zero Trust Transfer Orchestration Protocol
|
|
82
|
+
|
|
83
|
+
[](https://pypi.org/project/ztop/)
|
|
84
|
+
[](https://pypi.org/project/ztop/)
|
|
85
|
+
[](LICENSE)
|
|
86
|
+
|
|
87
|
+
ZTOP is a Python reference implementation of the **Zero Trust Transfer Orchestration Protocol**, an Application Layer (OSI Layer 7) protocol for cryptographically authenticated, continuously attested peer-to-peer file transfer in Zero Trust Architectures (ZTA).
|
|
88
|
+
|
|
89
|
+
---
|
|
90
|
+
|
|
91
|
+
## Overview
|
|
92
|
+
|
|
93
|
+
Traditional file transfer protocols (SFTP, FTP) authenticate once and establish a trusted channel. ZTOP integrates every Zero Trust principle natively into the protocol itself:
|
|
94
|
+
|
|
95
|
+
| Feature | Description |
|
|
96
|
+
|---|---|
|
|
97
|
+
| Cryptographic Peer Identity | HKDF-SHA512 + Ed25519 derived from hardware device UUID |
|
|
98
|
+
| Continuous Attestation | 16-field Heartbeat with 8 validation checks every 10 seconds |
|
|
99
|
+
| 5-Layer Certificate Chain | Root CA, Org CA, Device, Session, Transfer Receipt — X.509 P384 |
|
|
100
|
+
| Trust Scoring | 100-point composite posture score with 7-factor evaluation |
|
|
101
|
+
| Policy Engine | 6 independent checks before any transfer is authorized |
|
|
102
|
+
| Merkle Tree Integrity | Per-chunk SHA-256 verification with proof ascent |
|
|
103
|
+
| Cryptographic Execution Manifest | 380-byte signed CEM prepended to every transferred file |
|
|
104
|
+
| Pre-Execution Static Analysis | Entropy, PE/ELF/Python behavioral analysis before delivery |
|
|
105
|
+
| 7-Level Signature Chain | All 7 Ed25519 signatures required for SYNC_COMPLETE |
|
|
106
|
+
| Trust-Preserving Reconnection | Resumes from last verified chunk after disconnect |
|
|
107
|
+
| Real ECDSA-P384 Audit Records | Gateway seals every transfer with real P384 signatures |
|
|
108
|
+
|
|
109
|
+
---
|
|
110
|
+
|
|
111
|
+
## Installation
|
|
112
|
+
|
|
113
|
+
```bash
|
|
114
|
+
pip install ztop
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
Requires Python 3.11 or later.
|
|
118
|
+
|
|
119
|
+
### Development installation
|
|
120
|
+
|
|
121
|
+
```bash
|
|
122
|
+
git clone https://github.com/sripad2020/ztop-research
|
|
123
|
+
cd ztop-research
|
|
124
|
+
pip install -e ".[dev]"
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
---
|
|
128
|
+
|
|
129
|
+
## Quick Start
|
|
130
|
+
|
|
131
|
+
### Start a gateway server
|
|
132
|
+
|
|
133
|
+
```bash
|
|
134
|
+
ztop server
|
|
135
|
+
# or with custom address
|
|
136
|
+
ztop server --host 0.0.0.0 --port 7890 --log-level DEBUG
|
|
137
|
+
```
|
|
138
|
+
|
|
139
|
+
### Connect and upload a file
|
|
140
|
+
|
|
141
|
+
```bash
|
|
142
|
+
ztop client --file /path/to/document.pdf
|
|
143
|
+
# or specify target
|
|
144
|
+
ztop client --host 10.0.0.5 --port 7890 --file /path/to/file --device-id my-laptop --org-id acme-corp
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
### Run the self-contained demo (no setup required)
|
|
148
|
+
|
|
149
|
+
```bash
|
|
150
|
+
ztop demo
|
|
151
|
+
```
|
|
152
|
+
|
|
153
|
+
### Run the advanced X.509 certificate demo
|
|
154
|
+
|
|
155
|
+
```bash
|
|
156
|
+
ztop cert-demo
|
|
157
|
+
```
|
|
158
|
+
|
|
159
|
+
### Check version
|
|
160
|
+
|
|
161
|
+
```bash
|
|
162
|
+
ztop version
|
|
163
|
+
```
|
|
164
|
+
|
|
165
|
+
---
|
|
166
|
+
|
|
167
|
+
## Session Lifecycle
|
|
168
|
+
|
|
169
|
+
```
|
|
170
|
+
Client Gateway
|
|
171
|
+
| |
|
|
172
|
+
|-------- HELLO ----------------> | Phase 1: Discovery
|
|
173
|
+
|<------- DISCOVER --------------- |
|
|
174
|
+
|-------- REGISTER -------------> | Phase 2: Identity
|
|
175
|
+
|<------- IDENTITY_REQUEST ------- | Ed25519 challenge issued
|
|
176
|
+
|-------- IDENTITY_RESPONSE ----> | 64-byte sig + 32-byte pubkey
|
|
177
|
+
|-------- TRUST_REQUEST --------> | Phase 3: Device Posture
|
|
178
|
+
|<------- TRUST_RESPONSE --------- | Score assigned
|
|
179
|
+
|-------- POLICY_REQUEST -------> | Phase 4: Policy Evaluation
|
|
180
|
+
|<------- POLICY_RESPONSE -------- | 6-check authorization
|
|
181
|
+
|-------- CAPABILITY_NEGOTIATE -> | Phase 5: Negotiation
|
|
182
|
+
|<------- CAPABILITY_NEGOTIATE --- | chunk_size, window
|
|
183
|
+
|-------- SESSION_CREATE -------> | Phase 6: Session Active
|
|
184
|
+
|<------- SESSION_ACCEPT --------- |
|
|
185
|
+
|-------- TRANSFER_REQUEST -----> | Phase 7: File Transfer
|
|
186
|
+
|<------- TRANSFER_START --------- |
|
|
187
|
+
|-------- TRANSFER_CHUNK x N ---> | PAYLOAD_ENCRYPTED required
|
|
188
|
+
|<------- TRANSFER_ACK ----------- | per-chunk Merkle verification
|
|
189
|
+
|-------- TRANSFER_COMPLETE ----> | Phase 8: Audit
|
|
190
|
+
|<------- INTEGRITY_VERIFY ------- | SHA-3-512 file check
|
|
191
|
+
|<------- AUDIT_COMMIT ----------- | ECDSA-P384 sealed record
|
|
192
|
+
|-------- SESSION_CLOSE --------> | Phase 9: Graceful Close
|
|
193
|
+
|<------- SESSION_CLOSE ---------- |
|
|
194
|
+
```
|
|
195
|
+
|
|
196
|
+
---
|
|
197
|
+
|
|
198
|
+
## Architecture
|
|
199
|
+
|
|
200
|
+
```
|
|
201
|
+
ztop/
|
|
202
|
+
protocol/ Binary wire format (packet.py, states.py, messages.py)
|
|
203
|
+
core/ Session state management (session.py)
|
|
204
|
+
engines/
|
|
205
|
+
trust_engine.py Device posture scoring (100-point scale)
|
|
206
|
+
policy_engine.py 6-check transfer authorization
|
|
207
|
+
heartbeat_engine.py Continuous 8-check attestation
|
|
208
|
+
merkle_engine.py Binary SHA-256 Merkle tree
|
|
209
|
+
cem_engine.py Cryptographic Execution Manifest
|
|
210
|
+
audit_engine.py ECDSA-P384 audit record sealing
|
|
211
|
+
cert_engine.py X.509 5-layer certificate hierarchy
|
|
212
|
+
signature_chain.py 7-level Ed25519 signature chain
|
|
213
|
+
peer_id_engine.py HKDF hardware-derived Peer ID
|
|
214
|
+
integrity_engine.py Per-chunk and file-level hash verification
|
|
215
|
+
tamper_engine.py Adaptive Tamper Resistance Score (TRS)
|
|
216
|
+
execution_analyzer.py Pre-execution static behavioral analysis
|
|
217
|
+
reconnect_engine.py Trust-preserving session resumption
|
|
218
|
+
metadata_engine.py 19-field dual-signed metadata exchange
|
|
219
|
+
network/
|
|
220
|
+
server.py asyncio TCP gateway server
|
|
221
|
+
client.py asyncio client agent
|
|
222
|
+
cli.py click-based command-line interface
|
|
223
|
+
```
|
|
224
|
+
|
|
225
|
+
---
|
|
226
|
+
|
|
227
|
+
## Security Notes
|
|
228
|
+
|
|
229
|
+
- **Transport**: ZTOP is designed to run inside a TLS 1.3 tunnel. The reference implementation uses plain TCP for development convenience. For production use, place behind a TLS terminator or enable TLS in the network layer.
|
|
230
|
+
- **HMAC Keys**: The current implementation does not perform a key exchange during the handshake. Both sides use an unshared key by default, so HMAC validation is not enforced. A full ECDH-based key exchange is planned for v1.1.
|
|
231
|
+
- **Post-Quantum**: Ed25519 and ECDSA-P384 are not quantum-resistant. Future versions will incorporate NIST-standardized post-quantum algorithms.
|
|
232
|
+
|
|
233
|
+
See [SECURITY.md](SECURITY.md) for the full threat model and responsible disclosure policy.
|
|
234
|
+
|
|
235
|
+
---
|
|
236
|
+
|
|
237
|
+
## Running Tests
|
|
238
|
+
|
|
239
|
+
```bash
|
|
240
|
+
pip install -e ".[dev]"
|
|
241
|
+
pytest tests/ -v --tb=short
|
|
242
|
+
```
|
|
243
|
+
|
|
244
|
+
---
|
|
245
|
+
|
|
246
|
+
## Building for PyPI
|
|
247
|
+
|
|
248
|
+
```bash
|
|
249
|
+
python -m build
|
|
250
|
+
twine check dist/*
|
|
251
|
+
twine upload dist/*
|
|
252
|
+
```
|
|
253
|
+
|
|
254
|
+
---
|
|
255
|
+
|
|
256
|
+
## IETF Reference
|
|
257
|
+
|
|
258
|
+
This implementation targets **draft-ztop-secdispatch-protocol-00**, submitted to the IETF SECDISPATCH working group.
|
|
259
|
+
|
|
260
|
+
Internet-Draft: [https://datatracker.ietf.org/drafts/current/](https://datatracker.ietf.org/drafts/current/)
|
|
261
|
+
|
|
262
|
+
---
|
|
263
|
+
|
|
264
|
+
## License
|
|
265
|
+
|
|
266
|
+
MIT — see [LICENSE](LICENSE).
|
ztop-1.1.0/README.md
ADDED
|
@@ -0,0 +1,186 @@
|
|
|
1
|
+
# ZTOP — Zero Trust Transfer Orchestration Protocol
|
|
2
|
+
|
|
3
|
+
[](https://pypi.org/project/ztop/)
|
|
4
|
+
[](https://pypi.org/project/ztop/)
|
|
5
|
+
[](LICENSE)
|
|
6
|
+
|
|
7
|
+
ZTOP is a Python reference implementation of the **Zero Trust Transfer Orchestration Protocol**, an Application Layer (OSI Layer 7) protocol for cryptographically authenticated, continuously attested peer-to-peer file transfer in Zero Trust Architectures (ZTA).
|
|
8
|
+
|
|
9
|
+
---
|
|
10
|
+
|
|
11
|
+
## Overview
|
|
12
|
+
|
|
13
|
+
Traditional file transfer protocols (SFTP, FTP) authenticate once and establish a trusted channel. ZTOP integrates every Zero Trust principle natively into the protocol itself:
|
|
14
|
+
|
|
15
|
+
| Feature | Description |
|
|
16
|
+
|---|---|
|
|
17
|
+
| Cryptographic Peer Identity | HKDF-SHA512 + Ed25519 derived from hardware device UUID |
|
|
18
|
+
| Continuous Attestation | 16-field Heartbeat with 8 validation checks every 10 seconds |
|
|
19
|
+
| 5-Layer Certificate Chain | Root CA, Org CA, Device, Session, Transfer Receipt — X.509 P384 |
|
|
20
|
+
| Trust Scoring | 100-point composite posture score with 7-factor evaluation |
|
|
21
|
+
| Policy Engine | 6 independent checks before any transfer is authorized |
|
|
22
|
+
| Merkle Tree Integrity | Per-chunk SHA-256 verification with proof ascent |
|
|
23
|
+
| Cryptographic Execution Manifest | 380-byte signed CEM prepended to every transferred file |
|
|
24
|
+
| Pre-Execution Static Analysis | Entropy, PE/ELF/Python behavioral analysis before delivery |
|
|
25
|
+
| 7-Level Signature Chain | All 7 Ed25519 signatures required for SYNC_COMPLETE |
|
|
26
|
+
| Trust-Preserving Reconnection | Resumes from last verified chunk after disconnect |
|
|
27
|
+
| Real ECDSA-P384 Audit Records | Gateway seals every transfer with real P384 signatures |
|
|
28
|
+
|
|
29
|
+
---
|
|
30
|
+
|
|
31
|
+
## Installation
|
|
32
|
+
|
|
33
|
+
```bash
|
|
34
|
+
pip install ztop
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
Requires Python 3.11 or later.
|
|
38
|
+
|
|
39
|
+
### Development installation
|
|
40
|
+
|
|
41
|
+
```bash
|
|
42
|
+
git clone https://github.com/sripad2020/ztop-research
|
|
43
|
+
cd ztop-research
|
|
44
|
+
pip install -e ".[dev]"
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
---
|
|
48
|
+
|
|
49
|
+
## Quick Start
|
|
50
|
+
|
|
51
|
+
### Start a gateway server
|
|
52
|
+
|
|
53
|
+
```bash
|
|
54
|
+
ztop server
|
|
55
|
+
# or with custom address
|
|
56
|
+
ztop server --host 0.0.0.0 --port 7890 --log-level DEBUG
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
### Connect and upload a file
|
|
60
|
+
|
|
61
|
+
```bash
|
|
62
|
+
ztop client --file /path/to/document.pdf
|
|
63
|
+
# or specify target
|
|
64
|
+
ztop client --host 10.0.0.5 --port 7890 --file /path/to/file --device-id my-laptop --org-id acme-corp
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
### Run the self-contained demo (no setup required)
|
|
68
|
+
|
|
69
|
+
```bash
|
|
70
|
+
ztop demo
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
### Run the advanced X.509 certificate demo
|
|
74
|
+
|
|
75
|
+
```bash
|
|
76
|
+
ztop cert-demo
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
### Check version
|
|
80
|
+
|
|
81
|
+
```bash
|
|
82
|
+
ztop version
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
---
|
|
86
|
+
|
|
87
|
+
## Session Lifecycle
|
|
88
|
+
|
|
89
|
+
```
|
|
90
|
+
Client Gateway
|
|
91
|
+
| |
|
|
92
|
+
|-------- HELLO ----------------> | Phase 1: Discovery
|
|
93
|
+
|<------- DISCOVER --------------- |
|
|
94
|
+
|-------- REGISTER -------------> | Phase 2: Identity
|
|
95
|
+
|<------- IDENTITY_REQUEST ------- | Ed25519 challenge issued
|
|
96
|
+
|-------- IDENTITY_RESPONSE ----> | 64-byte sig + 32-byte pubkey
|
|
97
|
+
|-------- TRUST_REQUEST --------> | Phase 3: Device Posture
|
|
98
|
+
|<------- TRUST_RESPONSE --------- | Score assigned
|
|
99
|
+
|-------- POLICY_REQUEST -------> | Phase 4: Policy Evaluation
|
|
100
|
+
|<------- POLICY_RESPONSE -------- | 6-check authorization
|
|
101
|
+
|-------- CAPABILITY_NEGOTIATE -> | Phase 5: Negotiation
|
|
102
|
+
|<------- CAPABILITY_NEGOTIATE --- | chunk_size, window
|
|
103
|
+
|-------- SESSION_CREATE -------> | Phase 6: Session Active
|
|
104
|
+
|<------- SESSION_ACCEPT --------- |
|
|
105
|
+
|-------- TRANSFER_REQUEST -----> | Phase 7: File Transfer
|
|
106
|
+
|<------- TRANSFER_START --------- |
|
|
107
|
+
|-------- TRANSFER_CHUNK x N ---> | PAYLOAD_ENCRYPTED required
|
|
108
|
+
|<------- TRANSFER_ACK ----------- | per-chunk Merkle verification
|
|
109
|
+
|-------- TRANSFER_COMPLETE ----> | Phase 8: Audit
|
|
110
|
+
|<------- INTEGRITY_VERIFY ------- | SHA-3-512 file check
|
|
111
|
+
|<------- AUDIT_COMMIT ----------- | ECDSA-P384 sealed record
|
|
112
|
+
|-------- SESSION_CLOSE --------> | Phase 9: Graceful Close
|
|
113
|
+
|<------- SESSION_CLOSE ---------- |
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
---
|
|
117
|
+
|
|
118
|
+
## Architecture
|
|
119
|
+
|
|
120
|
+
```
|
|
121
|
+
ztop/
|
|
122
|
+
protocol/ Binary wire format (packet.py, states.py, messages.py)
|
|
123
|
+
core/ Session state management (session.py)
|
|
124
|
+
engines/
|
|
125
|
+
trust_engine.py Device posture scoring (100-point scale)
|
|
126
|
+
policy_engine.py 6-check transfer authorization
|
|
127
|
+
heartbeat_engine.py Continuous 8-check attestation
|
|
128
|
+
merkle_engine.py Binary SHA-256 Merkle tree
|
|
129
|
+
cem_engine.py Cryptographic Execution Manifest
|
|
130
|
+
audit_engine.py ECDSA-P384 audit record sealing
|
|
131
|
+
cert_engine.py X.509 5-layer certificate hierarchy
|
|
132
|
+
signature_chain.py 7-level Ed25519 signature chain
|
|
133
|
+
peer_id_engine.py HKDF hardware-derived Peer ID
|
|
134
|
+
integrity_engine.py Per-chunk and file-level hash verification
|
|
135
|
+
tamper_engine.py Adaptive Tamper Resistance Score (TRS)
|
|
136
|
+
execution_analyzer.py Pre-execution static behavioral analysis
|
|
137
|
+
reconnect_engine.py Trust-preserving session resumption
|
|
138
|
+
metadata_engine.py 19-field dual-signed metadata exchange
|
|
139
|
+
network/
|
|
140
|
+
server.py asyncio TCP gateway server
|
|
141
|
+
client.py asyncio client agent
|
|
142
|
+
cli.py click-based command-line interface
|
|
143
|
+
```
|
|
144
|
+
|
|
145
|
+
---
|
|
146
|
+
|
|
147
|
+
## Security Notes
|
|
148
|
+
|
|
149
|
+
- **Transport**: ZTOP is designed to run inside a TLS 1.3 tunnel. The reference implementation uses plain TCP for development convenience. For production use, place behind a TLS terminator or enable TLS in the network layer.
|
|
150
|
+
- **HMAC Keys**: The current implementation does not perform a key exchange during the handshake. Both sides use an unshared key by default, so HMAC validation is not enforced. A full ECDH-based key exchange is planned for v1.1.
|
|
151
|
+
- **Post-Quantum**: Ed25519 and ECDSA-P384 are not quantum-resistant. Future versions will incorporate NIST-standardized post-quantum algorithms.
|
|
152
|
+
|
|
153
|
+
See [SECURITY.md](SECURITY.md) for the full threat model and responsible disclosure policy.
|
|
154
|
+
|
|
155
|
+
---
|
|
156
|
+
|
|
157
|
+
## Running Tests
|
|
158
|
+
|
|
159
|
+
```bash
|
|
160
|
+
pip install -e ".[dev]"
|
|
161
|
+
pytest tests/ -v --tb=short
|
|
162
|
+
```
|
|
163
|
+
|
|
164
|
+
---
|
|
165
|
+
|
|
166
|
+
## Building for PyPI
|
|
167
|
+
|
|
168
|
+
```bash
|
|
169
|
+
python -m build
|
|
170
|
+
twine check dist/*
|
|
171
|
+
twine upload dist/*
|
|
172
|
+
```
|
|
173
|
+
|
|
174
|
+
---
|
|
175
|
+
|
|
176
|
+
## IETF Reference
|
|
177
|
+
|
|
178
|
+
This implementation targets **draft-ztop-secdispatch-protocol-00**, submitted to the IETF SECDISPATCH working group.
|
|
179
|
+
|
|
180
|
+
Internet-Draft: [https://datatracker.ietf.org/drafts/current/](https://datatracker.ietf.org/drafts/current/)
|
|
181
|
+
|
|
182
|
+
---
|
|
183
|
+
|
|
184
|
+
## License
|
|
185
|
+
|
|
186
|
+
MIT — see [LICENSE](LICENSE).
|
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=68", "wheel"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "ztop"
|
|
7
|
+
dynamic = ["version"]
|
|
8
|
+
description = "Zero Trust Transfer Orchestration Protocol -- RFC reference implementation (v1.1.0, 8 Advanced Upgrades)"
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
license = { file = "LICENSE" }
|
|
11
|
+
authors = [{ name = "ZTOP Research Group", email = "ztop@zero-trust-consortium.org" }]
|
|
12
|
+
keywords = ["zero-trust", "file-transfer", "protocol", "cryptography", "security"]
|
|
13
|
+
classifiers = [
|
|
14
|
+
"Development Status :: 4 - Beta",
|
|
15
|
+
"Environment :: Console",
|
|
16
|
+
"Intended Audience :: Developers",
|
|
17
|
+
"Intended Audience :: System Administrators",
|
|
18
|
+
"License :: OSI Approved :: MIT License",
|
|
19
|
+
"Operating System :: OS Independent",
|
|
20
|
+
"Programming Language :: Python :: 3",
|
|
21
|
+
"Programming Language :: Python :: 3.11",
|
|
22
|
+
"Programming Language :: Python :: 3.12",
|
|
23
|
+
"Programming Language :: Python :: 3.13",
|
|
24
|
+
"Topic :: Internet",
|
|
25
|
+
"Topic :: Security :: Cryptography",
|
|
26
|
+
"Topic :: System :: Networking",
|
|
27
|
+
"Typing :: Typed",
|
|
28
|
+
]
|
|
29
|
+
requires-python = ">=3.11"
|
|
30
|
+
dependencies = [
|
|
31
|
+
"cryptography>=41.0",
|
|
32
|
+
"click>=8.1",
|
|
33
|
+
]
|
|
34
|
+
|
|
35
|
+
[project.optional-dependencies]
|
|
36
|
+
dev = [
|
|
37
|
+
"pytest>=8.0",
|
|
38
|
+
"pytest-asyncio>=0.23",
|
|
39
|
+
"ruff>=0.4",
|
|
40
|
+
"mypy>=1.10",
|
|
41
|
+
"build>=1.2",
|
|
42
|
+
"twine>=5.0",
|
|
43
|
+
]
|
|
44
|
+
|
|
45
|
+
# Area 2 -- TLS 1.3 (stdlib ssl, no extra deps needed)
|
|
46
|
+
|
|
47
|
+
# Area 3 -- Post-Quantum ML-DSA (Dilithium / NIST FIPS 204)
|
|
48
|
+
pqc = [
|
|
49
|
+
"oqs-python>=0.9.0",
|
|
50
|
+
]
|
|
51
|
+
|
|
52
|
+
# Area 4 -- QUIC transport
|
|
53
|
+
quic = [
|
|
54
|
+
"aioquic>=0.9.25",
|
|
55
|
+
]
|
|
56
|
+
|
|
57
|
+
# Area 5 -- Real-Time SOC Dashboard
|
|
58
|
+
dashboard = [
|
|
59
|
+
"fastapi>=0.111",
|
|
60
|
+
"uvicorn[standard]>=0.30",
|
|
61
|
+
]
|
|
62
|
+
|
|
63
|
+
# Area 6 -- gRPC Management API
|
|
64
|
+
grpc = [
|
|
65
|
+
"grpcio>=1.64",
|
|
66
|
+
"grpcio-tools>=1.64",
|
|
67
|
+
"protobuf>=5.0",
|
|
68
|
+
]
|
|
69
|
+
|
|
70
|
+
# Area 7 -- Persistent Audit Store
|
|
71
|
+
storage = [
|
|
72
|
+
"aiosqlite>=0.20",
|
|
73
|
+
]
|
|
74
|
+
|
|
75
|
+
# Area 8 -- Advanced Execution Analysis
|
|
76
|
+
analysis = [
|
|
77
|
+
"yara-python>=4.5",
|
|
78
|
+
"scikit-learn>=1.5",
|
|
79
|
+
"numpy>=1.26",
|
|
80
|
+
]
|
|
81
|
+
|
|
82
|
+
# Install everything
|
|
83
|
+
full = [
|
|
84
|
+
"ztop[pqc,quic,dashboard,grpc,storage,analysis]",
|
|
85
|
+
]
|
|
86
|
+
|
|
87
|
+
[project.scripts]
|
|
88
|
+
ztop = "ztop.__main__:main"
|
|
89
|
+
|
|
90
|
+
[project.urls]
|
|
91
|
+
Homepage = "https://github.com/sripad2020/ztop-research"
|
|
92
|
+
Documentation = "https://github.com/sripad2020/ztop-research#readme"
|
|
93
|
+
Repository = "https://github.com/sripad2020/ztop-research"
|
|
94
|
+
"Bug Tracker" = "https://github.com/sripad2020/ztop-research/issues"
|
|
95
|
+
Changelog = "https://github.com/sripad2020/ztop-research/blob/main/CHANGELOG.md"
|
|
96
|
+
|
|
97
|
+
[tool.setuptools.dynamic]
|
|
98
|
+
version = { attr = "ztop._version.__version__" }
|
|
99
|
+
|
|
100
|
+
[tool.setuptools.packages.find]
|
|
101
|
+
where = ["."]
|
|
102
|
+
include = ["ztop*"]
|
|
103
|
+
|
|
104
|
+
[tool.setuptools.package-data]
|
|
105
|
+
ztop = [
|
|
106
|
+
"py.typed",
|
|
107
|
+
"engines/yara_rules/*.yar",
|
|
108
|
+
"engines/yara_rules/*.yara",
|
|
109
|
+
]
|
|
110
|
+
|
|
111
|
+
# ── Ruff (linting + formatting) ──────────────────────────────────────────────
|
|
112
|
+
[tool.ruff]
|
|
113
|
+
target-version = "py311"
|
|
114
|
+
line-length = 100
|
|
115
|
+
|
|
116
|
+
[tool.ruff.lint]
|
|
117
|
+
select = ["E", "F", "W", "I", "UP", "S", "B"]
|
|
118
|
+
ignore = ["S101", "S311"] # allow assert in tests, non-crypto random is fine where noted
|
|
119
|
+
|
|
120
|
+
# ── MyPy ─────────────────────────────────────────────────────────────────────
|
|
121
|
+
[tool.mypy]
|
|
122
|
+
python_version = "3.11"
|
|
123
|
+
strict = false
|
|
124
|
+
ignore_missing_imports = true
|
|
125
|
+
|
|
126
|
+
# ── Pytest ────────────────────────────────────────────────────────────────────
|
|
127
|
+
[tool.pytest.ini_options]
|
|
128
|
+
asyncio_mode = "auto"
|
|
129
|
+
testpaths = ["tests"]
|
|
130
|
+
log_cli = true
|
|
131
|
+
log_cli_level = "WARNING"
|
ztop-1.1.0/setup.cfg
ADDED