Sign inSign up

rocheston/zelen

By rocheston

โ€ขUpdated 4 months ago

Image
Security
0

284

rocheston/zelen repository overview

โ ZelEn โ€” Quantum-Safe Encryption CLI

ZelEn is a production-grade quantum-safe encryption toolkit implementing the ZelEn protocolโ  โ€” ML-KEM + ML-DSA (NIST FIPS 203/204) with AES-256-GCM and Argon2id passphrase protection.

Built with ๐Ÿ’› by Haja Moโ  ยท Websiteโ  ยท GitHubโ 


โ Quick Start

# Pull the image
docker pull rocheston/zelen:latest

# Check version
docker run --rm rocheston/zelen:latest --version

# Launch the web playground at http://localhost:8888
docker run -p 8888:8888 rocheston/zelen:latest

โ Web Playground

ZelEn ships a built-in Gruvbox-themed web UI for key generation, encryption, decryption, signing, and inspection โ€” no CLI needed.

docker run -d \
  --name zelen-playground \
  -p 8888:8888 \
  rocheston/zelen:latest

# Open http://localhost:8888 in your browser

โ CLI Usage

Mount a local directory as /data to work with files:

alias zelen='docker run --rm -v $(pwd):/data -w /data rocheston/zelen:latest'
โ Key Management
# Generate a key pair (PQ5 suite โ€” ML-KEM-1024 + ML-DSA-87)
zelen keys generate --subject [email protected] --name "Alice" --out alice

# List key info
zelen keys inspect --key alice.zkey

# Inspect a public key
zelen keys inspect --key alice.zpub
โ Encryption
# Encrypt a text message
zelen encrypt text \
  --recipient alice.zpub \
  --text "Hello, quantum world!" \
  --out message.zelen

# Encrypt a file
zelen encrypt file \
  --recipient alice.zpub \
  --input secret.pdf \
  --out secret.zelen

# Encrypt and sign
zelen encrypt text \
  --recipient alice.zpub \
  --text "Signed message" \
  --sign-key sender.zkey \
  --out signed.zelen
โ Decryption
# Decrypt a message
zelen decrypt text \
  --key alice.zkey \
  --input message.zelen

# Decrypt a file
zelen decrypt file \
  --key alice.zkey \
  --input secret.zelen \
  --out recovered.pdf

# Decrypt with passphrase from env
ZELEN_PASS=mysecret zelen decrypt text \
  --key alice.zkey \
  --passphrase-env ZELEN_PASS \
  --input message.zelen
โ Sign & Verify
# Sign a file
zelen sign --key alice.zkey --input report.pdf --out report.sig

# Verify a signature
zelen verify --key alice.zpub --input report.pdf --sig report.sig
โ Armor
# Convert binary .zelen to ASCII armor (.asc)
zelen armor --input message.zelen --out message.zelen.asc

# Dearmor back to binary
zelen dearmor --input message.zelen.asc --out message.zelen
โ Inspect a Container
# View .zelen container header fields
zelen inspect --input message.zelen
โ System
# Run diagnostics
zelen doctor

# Run self-test suite
zelen self-test

# Run benchmarks
zelen bench

# Generate shell completions (bash/zsh/fish)
zelen completions bash > /etc/bash_completion.d/zelen

โ Suites

SuiteKEMSignatureSecurity
pq3ML-KEM-768ML-DSA-65NIST Level 3
pq5 (default)ML-KEM-1024ML-DSA-87NIST Level 5
pq5-slhML-KEM-1024SLH-DSA-256NIST Level 5 + stateless hash sig

โ Environment Variables

VariableDescription
ZELEN_PASSPassphrase for key unwrapping (use with --passphrase-env ZELEN_PASS)
ZELEN_LOGLog level: error, warn, info, debug, trace
ZELEN_CONFIGPath to config file (default: ~/.zelen/config.toml)

โ Docker Compose

services:
  zelen:
    image: rocheston/zelen:latest
    ports:
      - "8888:8888"
    volumes:
      - ./keys:/home/zelen/keys
    restart: unless-stopped

โ Security

  • Private keys are CSPRNG-generated โ€” passphrases only wrap them (Argon2id + AES-256-GCM), never derive them
  • Decryption is fail-closed โ€” generic AuthenticationFailed errors, no oracle leakage
  • Secret material is zeroized on drop via the zeroize crate
  • Container integrity uses constant-time MAC comparison

See SECURITY.mdโ  for the full security policy.


โ Tags

TagDescription
latestMost recent stable release
1.2.0ZelEn v1.2.0

Platform: linux/amd64

Tag summary

Content type

Image

Digest

sha256:d8e2cc2e0โ€ฆ

Size

33.3 MB

Last updated

4 months ago

docker pull rocheston/zelen