Class Guard

java.lang.Object
zeroecho.Guard
public final class Guard extends Object
Guard is a unified subcommand that encrypts and decrypts using a multi-recipient envelope with AES or ChaCha payloads.

Overview

The class replaces the previous MultiRecipientAes and PasswordBasedAes CLIs by exposing a single entry point. It builds an envelope with a recipients table (real and decoy) via MultiRecipientDataSourceBuilder, then delegates the payload to either AesDataContentBuilder or ChaChaDataContentBuilder.

Default behavior:

  • Recipients are shuffled by default to harden traffic analysis. Disable with --no-shuffle.
  • The symmetric stage writes and parses its own header by default.

Keyring resolution

Recipient aliases and the unlocking alias are resolved from KeyringStore. The algorithm id stored in the keyring drives which recipient method to call, so the user does not have to specify the algorithm again.

Payload selection

Use --alg to choose one of: aes-gcm, aes-ctr, aes-cbc-pkcs7, aes-cbc-nopad, chacha-aead, chacha-stream.

Examples

# Encrypt with KEM + RSA recipients, 2 decoy passwords, AES-GCM
ZeroEcho -G --encrypt in.bin --ks keys.txt \
  --to-alias alice --to-alias bob \
  --decoy-psw-rand 2 \
  --pbkdf2-max "$PBKDF2_POLICY_MAX" \
  --pbkdf2-hard-max "$PBKDF2_HARD_MAX" \
  --alg aes-gcm --tag-bits 128 --aad-hex 01ff

# Decrypt with private key (payload is ChaCha20-Poly1305)
ZeroEcho -G --decrypt blob.bin --ks keys.txt \
  --priv-alias alice \
  --alg chacha-aead

  • Method Details

    • main

      public static int main(String[] args, org.apache.commons.cli.Options options) throws org.apache.commons.cli.ParseException, IOException, GeneralSecurityException
      Entry point for the Guard subcommand. It preserves Apache Commons CLI usage and the subcommand invocation pattern used by ZeroEcho.
      Parameters:
      args - command-line arguments
      options - options object provided by the dispatcher; this method augments it
      Returns:
      exit code (0 = success, non-zero = failure)
      Throws:
      org.apache.commons.cli.ParseException - on CLI parsing errors
      IOException - on I/O errors
      GeneralSecurityException - on cryptographic setup or keyring errors

    • main

      public static int main(String[] args, org.apache.commons.cli.Options options, KeyringUnlockProvider keyringUnlockProvider) throws org.apache.commons.cli.ParseException, IOException, GeneralSecurityException
      Executes Guard with an explicit keyring unlock source.
      Parameters:
      args - command arguments
      options - dispatcher options
      keyringUnlockProvider - destroyable-password provider
      Returns:
      process exit code
      Throws:
      org.apache.commons.cli.ParseException - if parsing fails
      IOException - if I/O fails
      GeneralSecurityException - if cryptographic processing fails