CipherForge

Safe Cryptographic Primitives for Developers

CipherForge is an open-source cryptographic toolkit that makes it easy to use cryptography correctly. It provides safe defaults, bans insecure algorithms, and includes post-quantum migration paths — so developers can't accidentally get crypto wrong.

Why CipherForge?

95% of web applications have at least one cryptographic misconfiguration (Veracode 2024). Most developers aren't crypto experts, yet they're expected to implement crypto correctly. CipherForge eliminates this gap by:

• Banning insecure algorithms — MD5, SHA-1, DES, 3DES, RC4 are all blocked at the API level
• Enforcing safe defaults — AES-256-GCM, Ed25519, PBKDF2 with 600K iterations
• Post-quantum ready — ML-KEM, ML-DSA, SLH-DSA integration via liboqs
• Compliance auditing — Scans codebases for crypto misuse (NIST SP 800-57, CNSA 2.0, OWASP)

Quick Start

pip install cipherforge

# Hash (safe algorithms only)
cipherforge hash "my secret data" --algo sha256

# Encrypt (AES-256-GCM with proper KDF)
cipherforge encrypt --password "my-password" -o secret.enc sensitive.txt

# Generate keys
cipherforge keygen --algo ed25519 -o ./keys

# Scan code for crypto issues
cipherforge audit ./my-project

# Check compliance
cipherforge compliance ./my-project

# PQC info
cipherforge pqc info

Commands

Command	Description
cipherforge hash	Generate cryptographic hashes (SHA-256/384/512, BLAKE2b)
cipherforge encrypt	Encrypt with AES-256-GCM (safe defaults)
cipherforge decrypt	Decrypt AES-256-GCM encrypted data
cipherforge sign	Sign with Ed25519
cipherforge verify	Verify Ed25519 signatures
cipherforge keygen	Generate key pairs (Ed25519, X25519, PQC)
cipherforge audit	Scan code for insecure crypto patterns
cipherforge compliance	Check NIST/CNSA 2.0/GDPR compliance
cipherforge pqc	Post-quantum cryptography operations

Security Guarantees

CipherForge enforces these standards by default:

Category	CipherForge	Typical Mistake
Symmetric encryption	AES-256-GCM	DES, 3DES, RC4, ECB mode
Hashing	SHA-256+ or BLAKE2b	MD5, SHA-1
Key derivation	PBKDF2-SHA512 (600K iter)	MD5(password)
Asymmetric	Ed25519, X25519	RSA-1024, ECDSA-P192
RNG	os.urandom(), secrets	random.random()
Password hashing	bcrypt, scrypt, Argon2id	SHA256(password)
Signatures	Ed25519	DSA, RSA-1024

Post-Quantum Cryptography

CipherForge includes support for all NIST FIPS 203/204/205 standardized algorithms:

• ML-KEM (Kyber) — Key encapsulation for key exchange
• ML-DSA (Dilithium) — Digital signatures
• SLH-DSA (SPHINCS+) — Hash-based signatures (defense in depth)

# See PQC algorithm recommendations
cipherforge pqc info

# Generate PQC keys (requires liboqs)
pip install cipherforge[pqc]
cipherforge pqc keygen

Configuration

{
  "banned_algorithms": ["md5", "sha1", "des", "3des", "rc4"],
  "min_rsa_bits": 4096,
  "min_ecdsa_bits": 384,
  "enforce_pqc": false
}

Contributing

See CONTRIBUTING.md for guidelines.

License

Apache License 2.0 — see LICENSE.