The framework

The framework is the foundation of ZeroEcho: a single library that unifies classic and post‑quantum cryptography behind one consistent API, together with an SDK for building cryptographic applications. Everything else — including the certificate authority — is an application layered on this base.

What the framework provides

• A unified algorithm suite

  Symmetric ciphers (AES, ChaCha), hashes and MACs, classic public‑key algorithms (RSA, elliptic‑curve, EdDSA and relatives), and post‑quantum families for signatures (ML‑DSA, SLH‑DSA, SPHINCS+) and key establishment (ML‑KEM and other KEMs) — all reachable through one API.

• An application SDK

  Algorithm discovery, key generation, streaming sign/verify, key encapsulation, hybrid classic + post‑quantum constructions, and authenticated content protection.

• X.509 building blocks

  A JCA‑aligned API for constructing and parsing certificates, certification requests, CRLs, and OCSP messages.

• Keys and extension seams

  A protected keyring for private keys, and service‑provider seams for storage, signing, and the underlying cryptographic provider.

Read this section in order

1. Architecture — how the framework and the applications on it fit together.
2. Modules — the module map and dependencies.
3. The library & SDK — the public API, with examples.
4. Understanding the cryptography — how the cryptography works, and the risks.
5. Working with cryptography — hands‑on classic and post‑quantum recipes.
6. Extending the framework — implement and register providers.

Where to start by goal

Build on the cryptographyRun the certificate authorityExtend or embed

Add the library as a dependency and use the SDK and the zeroecho.pkix API directly. Begin with The library & SDK and Working with cryptography.

Deploy and operate the flagship application built on the framework. Begin with Deployment and Administration.

Swap the persistence backend, delegate signing to an external signer, or plug in a provider. Begin with Extending the framework.

The framework carries applications of any size — see the Applications overview for what is built on it.

Source quality gates

Java changes must keep the module compilation, PMD, and strict Javadoc gates green. Public and protected APIs document parameter constraints and units, return semantics, exact exception conditions, and relevant lifecycle, thread-safety, or persistence effects. Source files retain the complete project license header and use LF line endings.

Run ./gradlew compileJava pmdMain javadoc before submitting a Java change. Module-qualified tasks such as :pki-server:javadoc provide a faster feedback loop while editing.