sare — Safe At Rest Encryption

A hybrid post-quantum encryption tool for files at rest, written in Rust — classical and post-quantum algorithms, combined, so your files survive today's attackers and tomorrow's quantum computers.

$ cargo install sare-cli

source	github.com/SareProject/sare
status	beta — not yet independently audited
license	MIT OR Apache-2.0 · docs under CC BY 4.0
kem	X25519 + Kyber768 (hybrid)
signature	Ed25519 + Dilithium3 (hybrid)
seed	128-byte master seed → every private key

Description

Sare encrypts files at rest and defends them against two kinds of attackers: the one with today's computer, and the one with tomorrow's quantum computer. It never bets your files on a single algorithm. Every secret passes through a classical and a post-quantum primitive at the same time, so a breakthrough against either one still leaves the ciphertext standing.

The project is written in Rust, builds on well-vetted, widely audited algorithms and implementations, and is deliberately modular: encryption, signing and key derivation are swappable parts, ready for whatever post-quantum schemes get standardized next. It ships as two artifacts — sare-lib for Rust programs, sare-cli for humans.

master seedOne 128-byte seed derives every private key you will ever have.

hybrid KEMX25519 and Kyber768 together derive the shared secret that protects each file.

hybrid signaturesEd25519 and Dilithium3 sign every file; both must validate.

validation certificatesOthers can verify that your public keys are genuinely yours.

revocation certificatesRetire a compromised or obsolete key, and broadcast the fact.

recipientsShare with other people through their public keys, not through passwords.

two modesSymmetric, for your own files at rest; asymmetric, for files you share.

A file encrypted by Sare is a self-describing container:

+------+------------+------------+------------+
|header|  metadata  | ciphertext | signature? |
+------+------------+------------+------------+

fig. 1 — layout of an encrypted file; the signature is optional

And the hybrid construction at its core:

    classical                  post-quantum
+--------------+            +--------------+
|   X25519     |            |   Kyber768   |
+------+-------+            +------+-------+
       |                           |
       +----------+      +---------+
                  v      v
              hybrid KEM
   one shared secret, two hard problems

    classical                  post-quantum
+--------------+            +--------------+
|   Ed25519    |            |  Dilithium3  |
+------+-------+            +------+-------+
       |                           |
       +----------+      +---------+
                  v      v
          hybrid signature
     both signatures must validate

fig. 2 — the hybrid scheme: no single algorithm is trusted alone

Usage

sare-cli is the command-line interface. The shape of it:

sare-cli masterkey generate --hybrid-kem-algorithm ALG
                            --hybrid-sign-algorithm ALG
sare-cli encrypt symmetric IN OUT
sare-cli encrypt asymmetric IN OUT --recipient ID --masterkey-id ID
sare-cli decrypt IN OUT
sare-cli signature generate IN SIG --masterkey-id ID
sare-cli signature verify SIG IN
sare-cli recipient add FILE
sare-cli recipient list
sare-cli revocation new --masterkey-id ID

Examples

example 1 — files at rest

$ sare-cli masterkey generate --hybrid-kem-algorithm X25519_KYBER768 \
      --hybrid-sign-algorithm ED25519_DILITHIUM3
# one 128-byte seed now derives every private key you own

$ sare-cli encrypt symmetric report.txt report.enc
# passphrase-based — for your own files

$ sare-cli decrypt report.enc report.txt

$ sare-cli signature generate report.txt report.sig --masterkey-id MASTER_KEY_ID
$ sare-cli signature verify report.sig report.txt
# Ed25519 + Dilithium3 — both signatures must validate

example 2 — sharing and revocation

$ sare-cli recipient add recipient.pem
$ sare-cli encrypt asymmetric input.txt output.enc \
      --recipient RECIPIENT_ID --masterkey-id MASTER_KEY_ID
# the file is sealed to the recipient's public key

$ sare-cli revocation new --masterkey-id MASTER_KEY_ID
# retire a compromised or obsolete key

Writing Rust instead? Embed Sare with the sare-lib high-level API — the sare-cli sources double as a complete example.

Caveats

Sare is beta software and has not been independently audited — the project says so itself. Use it at your own risk, and keep truly sensitive files on something else for now. If you do use it, guard the master seed: every key you have comes from it.

beta — unaudited

sare-cli(1)	command reference and more examples — github.com/SareProject/sare/tree/main/sare-cli
sare-lib(3)	embed Sare in Rust applications — github.com/SareProject/sare/blob/main/sare-lib
docs	the full Sare documentation — sareproject.github.io/docs
support	where to ask for help — sareproject.github.io/docs/support
crates.io	crates.io/crates/sare-cli

sare — Safe At Rest Encryption

Description

Usage

Examples

Caveats

See also