mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.9 KiB
2.9 KiB
AES Encryption Implementation Template
Pre-Implementation Checklist
- Identify data classification level and regulatory requirements
- Determine key management strategy (local, HSM, KMS)
- Select AES mode (GCM recommended for authenticated encryption)
- Define key derivation parameters (algorithm, iterations)
- Plan nonce/IV generation strategy
- Determine encrypted file format and metadata storage
- Review compliance requirements (PCI-DSS, HIPAA, GDPR)
Configuration Parameters
encryption:
algorithm: AES-256-GCM
key_length: 256
nonce_length: 96 # bits
tag_length: 128 # bits
key_derivation:
algorithm: PBKDF2-SHA256
iterations: 600000
salt_length: 128 # bits
file_format:
magic_bytes: "AES256GCM"
version: 1
header: "magic || version || salt || nonce"
body: "ciphertext || tag"
Integration Code Template
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
import os
def encrypt_data(plaintext: bytes, password: str) -> bytes:
"""Encrypt data with AES-256-GCM."""
salt = os.urandom(16)
kdf = PBKDF2HMAC(
algorithm=hashes.SHA256(),
length=32,
salt=salt,
iterations=600_000,
)
key = kdf.derive(password.encode())
nonce = os.urandom(12)
aesgcm = AESGCM(key)
ciphertext = aesgcm.encrypt(nonce, plaintext, None)
return salt + nonce + ciphertext
def decrypt_data(data: bytes, password: str) -> bytes:
"""Decrypt AES-256-GCM encrypted data."""
salt = data[:16]
nonce = data[16:28]
ciphertext = data[28:]
kdf = PBKDF2HMAC(
algorithm=hashes.SHA256(),
length=32,
salt=salt,
iterations=600_000,
)
key = kdf.derive(password.encode())
aesgcm = AESGCM(key)
return aesgcm.decrypt(nonce, ciphertext, None)
Testing Checklist
- Encrypt and decrypt a small text file
- Encrypt and decrypt a large binary file (>100MB)
- Verify wrong password raises authentication error
- Verify tampered ciphertext raises authentication error
- Verify nonce uniqueness across multiple encryptions
- Measure encryption throughput (MB/s)
- Test with empty files and edge cases
Common Pitfalls
| Pitfall | Impact | Mitigation |
|---|---|---|
| Nonce reuse with same key | Complete loss of confidentiality in GCM | Always generate random nonce per encryption |
| Low PBKDF2 iterations | Brute-force password attacks | Use minimum 600,000 iterations |
| ECB mode usage | Pattern leakage in ciphertext | Always use GCM or CBC (never ECB) |
| No authentication | Undetected ciphertext modification | Use AEAD modes (GCM, CCM) |
| Hardcoded keys | Key compromise | Use KMS, HSM, or environment variables |
| No key rotation | Extended exposure window | Implement periodic key rotation policy |