2026-10-08T13:00:06Z https://api.figshare.com/v2/oai

oai:figshare.com:article/34046034 2026-10-02T16:45:20Z category_28903 category_28924 category_28909 category_28906 item_type_14 month_year_10_2026

<b>cryptoflex v0.5.4: A Security-Hardened Local-First Crypto-Agility Policy Engine for Hybrid Classical and Post-Quantum Key Exchange</b> KEERTHIVASAN S (24566574) Cryptography Cybersecurity and privacy not elsewhere classified Data security and protection Data and information privacy ML-KEM, X25519 local-first security policy engine authenticated encryption streaming AEAD reproducible builds post-quantum cryptography crypto-agility key encapsulation mechanism hybrid key exchange <p dir="ltr">The transition from classical to post-quantum cryptography (PQC) presents a critical challenge for software systems that rely on hardcoded algorithmic choices. Most encryption tools select a single cryptographic stack at build time and never revisit that decision, creating a maintainability and security liability as algorithms are deprecated or broken. While large-scale network protocols such as Signal’s PQXDH and Chrome’s X25519Kyber768 have already shipped hybrid classical+PQC key exchange, the local-first domain — file encryption utilities, desktop applications, and embedded/IoT systems — remains underserved.<br><br>This paper presents cryptoflex v0.5.4, a security-hardened local-first crypto-agility policy engine for Python that orchestrates existing, independently audited cryptographic primitives behind a runtime decision layer. The system combines classical X25519 elliptic-curve Diffie-Hellman with NIST-standardized Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) via the Open Quantum Safe (liboqs) library. A versioned, bundled risk table enables algorithm deprecation without network dependency. A deterministic hybrid combiner binds all shared secrets and ciphertexts into a single 256-bit root key via HKDFSHA384 with injective length-prefixed encoding, achieving the standard “at-least-as-strongas-the-strongest-component” design goal.</p> 2026-10-02T16:45:20Z Text Conference contribution 10.6084/m9.figshare.34046034.v2 https://figshare.com/articles/conference_contribution/_b_cryptoflex_v0_5_4_A_Security-Hardened_Local-First_Crypto-Agility_Policy_Engine_for_Hybrid_Classical_and_Post-Quantum_Key_Exchange_b_/34046034 CC BY 4.0