| Crates.io | shield-core |
| lib.rs | shield-core |
| version | 1.1.0 |
| created_at | 2026-01-12 19:29:23.078079+00 |
| updated_at | 2026-01-17 17:19:22.853035+00 |
| description | EXPTIME-secure encryption library - Rust core implementation |
| homepage | |
| repository | https://github.com/Guard8.ai/Shield |
| max_upload_size | |
| id | 2038660 |
| size | 347,465 |
EXPTIME-secure encryption library for Rust - symmetric cryptography with proven exponential-time security.
Shield uses only symmetric primitives with EXPTIME-hard security guarantees. Breaking requires 2^256 operations - no shortcut exists:
[dependencies]
shield-core = "1.1"
For WebAssembly:
[dependencies]
shield-core = { version = "1.1", features = ["wasm"] }
For Confidential Computing (TEE attestation):
[dependencies]
shield-core = { version = "1.1", features = ["confidential"] }
use shield_core::Shield;
// Password-based encryption
let shield = Shield::new("my_password", "github.com");
let encrypted = shield.encrypt(b"secret data")?;
let decrypted = shield.decrypt(&encrypted)?;
use shield_core::{quick_encrypt, quick_decrypt};
let key = [0u8; 32]; // Your 32-byte key
let encrypted = quick_encrypt(&key, b"data")?;
let decrypted = quick_decrypt(&key, &encrypted)?;
use shield_core::StreamCipher;
let cipher = StreamCipher::from_password("password", b"salt");
let data = vec![0u8; 1024 * 1024]; // 1MB
let encrypted = cipher.encrypt(&data)?;
let decrypted = cipher.decrypt(&encrypted)?;
use shield_core::RatchetSession;
let root_key = [0u8; 32]; // Exchanged via secure channel
let mut alice = RatchetSession::new(&root_key, true);
let mut bob = RatchetSession::new(&root_key, false);
// Each message uses a new key
let encrypted = alice.encrypt(b"Hello Bob!")?;
let decrypted = bob.decrypt(&encrypted)?;
std (default): Standard library supportcli (default): Command-line interface (shield binary)wasm: WebAssembly support via wasm-bindgenasync: Async runtime support (Tokio)confidential: Confidential Computing with TEE attestationopenapi: OpenAPI/Swagger schema generation for APIs# Install
cargo install shield-core
# Encrypt/decrypt files
shield encrypt secret.txt -o secret.enc
shield decrypt secret.enc -o secret.txt
# Check password strength
shield check "MyP@ssw0rd123"
# Encrypt text directly
shield text encrypt "hello" -p password -s service
# Generate random key
shield keygen
# Show info
shield info
use shield_core::password::{check_password, StrengthLevel};
let result = check_password("MyP@ssw0rd123");
println!("Entropy: {:.1} bits", result.entropy);
println!("Level: {:?}", result.level); // Strong
println!("Crack time: {}", result.crack_time_display());
if !result.is_acceptable() {
for suggestion in &result.suggestions {
println!("Suggestion: {}", suggestion);
}
}
Hardware-based attestation for Trusted Execution Environments (requires confidential feature).
| Platform | Provider | Attestation |
|---|---|---|
| AWS Nitro Enclaves | NitroAttestationProvider |
COSE-signed PCR measurements |
| GCP Confidential VMs | SEVAttestationProvider |
AMD SEV-SNP + vTPM |
| Azure Confidential | MAAAttestationProvider |
Microsoft Azure Attestation |
| Intel SGX | SGXAttestationProvider |
DCAP quotes (MRENCLAVE/MRSIGNER) |
use shield_core::confidential::{
AttestationProvider, NitroAttestationProvider,
TEEKeyManager, KeyReleasePolicy,
};
use std::sync::Arc;
// Create provider for your platform
let provider = Arc::new(NitroAttestationProvider::new()
.with_expected_pcr(0, "expected_pcr0_hash")
.with_max_age(300));
// Key manager with attestation gating
let key_manager = TEEKeyManager::new(
"master_password",
"my-service",
provider,
);
// Get keys only after attestation verification
let key = key_manager.derive_key(&attestation_evidence).await?;
use shield_core::confidential::{SealedStorage, SGXSealPolicy};
let storage = SealedStorage::new(SGXSealPolicy::MRENCLAVE);
storage.store("my_key", &secret_data).await?;
let data = storage.load("my_key").await?;
Main encryption struct with password-derived keys.
impl Shield {
fn new(password: &str, service: &str) -> Self;
fn with_key(key: &[u8; 32]) -> Self;
fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>;
fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>>;
}
Streaming encryption for large files.
impl StreamCipher {
fn new(key: &[u8; 32]) -> Self;
fn from_password(password: &str, salt: &[u8]) -> Self;
fn encrypt(&self, data: &[u8]) -> Result<Vec<u8>>;
fn decrypt(&self, encrypted: &[u8]) -> Result<Vec<u8>>;
}
Forward secrecy with key ratcheting.
impl RatchetSession {
fn new(root_key: &[u8; 32], is_initiator: bool) -> Self;
fn encrypt(&mut self, plaintext: &[u8]) -> Result<Vec<u8>>;
fn decrypt(&mut self, ciphertext: &[u8]) -> Result<Vec<u8>>;
}
Password strength analysis.
impl PasswordStrength {
fn length: usize; // Password length
fn entropy: f64; // Bits of entropy
fn level: StrengthLevel; // Critical/Weak/Fair/Strong/VeryStrong
fn crack_time_seconds: f64; // Estimated crack time
fn suggestions: Vec<String>;// Improvement suggestions
fn is_acceptable(&self) -> bool;
fn is_recommended(&self) -> bool;
fn crack_time_display(&self) -> String;
}
Shield produces byte-identical output across all implementations:
pip install shield-cryptocargo add shield-corenpm install @guard8/shieldShield uses only symmetric primitives with unconditional security:
Breaking requires 2^256 operations - no shortcut exists.
This crate uses #![forbid(unsafe_code)] and relies on audited cryptographic libraries:
ring for PBKDF2, HMAC-SHA256, and random number generationsubtle for constant-time operationsCC0-1.0 (Public Domain) - Use freely, no attribution required.