secure-string-cipher
A Beta AES-256-GCM encryption CLI with a passphrase vault, managed keys, and modern cryptographic defaults. Beta means the current v5/v2 format is usable and compatibility-sensitive, but the project is not yet stable or independently audited.
Beta Scope
- File APIs treat regular files as opaque bytes. MAXFILESIZE is an inclusive
100 MiB plaintext-payload limit; an SSC file may be larger because its magic, metadata, salt, nonce, and authentication tag are framing overhead. Directories and other special files are not supported.
- Active and candidate vault representations, plus legacy key files, separately
use the same 100 MiB value as a raw-input cap. Vault text is counted by UTF-8 bytes, and a value that could not be read back within the cap is not written.
- originalfilename is bounded metadata, not a path. The current version 5 and version 2
readers authenticate it before sanitizing it for automatic output selection; an explicit output remains authoritative. Version 4 names are never used to select an output.
- Large framed SSC2 objects and a third-party security audit remain future
work. Cross-process vault locking is implemented (advisory file locks with a bounded timeout); it has not been tested against real concurrent processes on every supported platform.
CI enforces a minimum 85% test coverage threshold on Python 3.14. The workflow also defines focused file and portable vault validation/transaction gates on Ubuntu, macOS, and Windows with Python 3.12; real OS keychain services are not tested there. The workflows are the current source of truth; dated acceptance records are clearly separated in the documentation archive.
Features
- AES-256-GCM encryption for text and files with authenticated encryption
- Argon2id key derivation – memory-hard, GPU/ASIC resistant
- Key commitment scheme – binds each ciphertext to its derived key
- Combined authentication (V2) – encrypt so that a single grant requires both
a password and a managed key together (--with password --with key:ID --require all); each object still carries exactly one access grant, not independent multi-credential access
- Legacy key-file mode – hashes any file's bytes into a symmetric passphrase
(SHA-256 → Argon2id); this is not public-key or recipient encryption
- Managed Keys (V2) – .ssckey