Class Kem

java.lang.Object
zeroecho.Kem
public final class Kem extends Object
Command-line utility that performs hybrid file encryption and decryption using a KEM envelope and an AES or ChaCha payload.

Overview

This tool encapsulates a symmetric key with a selected KEM (post-quantum friendly) and then applies a symmetric cipher to the payload. The symmetric stage is configured on KemDataContentBuilder and supports AES (GCM/CTR/CBC) and ChaCha (AEAD or stream) including AAD, IV/nonce, counters, and an optional compact header. Keys are loaded from KeyringStore by alias. Use --list-kems to discover valid KEM identifiers.

Examples

# List available KEM identifiers
ZeroEcho -E --list-kems

# Encrypt with Kyber768 + AES-GCM (128-bit tag), writing a header
ZeroEcho -E --encrypt in.bin -o out.bin --keyring keys.txt --pub alice-pub \
  --kem ML-KEM --hkdf 5a45524f --key-bytes 32 --max-kem-ct 65536 \
  --aes --aes-cipher gcm --aes-tag-bits 128 --aad DEADBEEF --header

# Decrypt with the corresponding private key
ZeroEcho -E --decrypt out.bin -o plain.bin --keyring keys.txt --priv alice-priv \
  --kem ML-KEM --aes --aes-cipher gcm --aes-tag-bits 128 --header

# Encrypt with ChaCha20-Poly1305 (AEAD) and header
ZeroEcho -E --encrypt in.bin -o out.cc20p.bin --keyring keys.txt --pub alice-pub \
  --kem ML-KEM --chacha --chacha-nonce 00112233445566778899AABB \
  --aad 01020304 --header

# Encrypt with ChaCha20 stream mode and explicit counters
ZeroEcho -E --encrypt in.bin -o out.cc20.bin --keyring keys.txt --pub alice-pub \
  --kem ML-KEM --chacha --chacha-nonce 00112233445566778899AABB \
  --chacha-initial 1 --chacha-counter 00000007

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final org.apache.commons.cli.Option
    OPT_AAD
    AAD (hex): --aad <hex>
    static final org.apache.commons.cli.Option
    OPT_AES
    Payload switch: --aes
    static final org.apache.commons.cli.Option
    OPT_AES_CIPHER
    AES mode: --aes-cipher gcm|ctr|cbc
    static final org.apache.commons.cli.Option
    OPT_AES_IV
    AES IV: --aes-iv <hex>
    static final org.apache.commons.cli.Option
    OPT_AES_TAG_BITS
    AES tag bits: --aes-tag-bits <int>
    static final org.apache.commons.cli.Option
    OPT_CHACHA
    Payload switch: --chacha
    static final org.apache.commons.cli.Option
    OPT_CHACHA_COUNTER
    ChaCha counter value: --chacha-counter <int>
    static final org.apache.commons.cli.Option
    OPT_CHACHA_INITIAL
    ChaCha initial counter: --chacha-initial <int>
    static final org.apache.commons.cli.Option
    OPT_CHACHA_NONCE
    ChaCha nonce: --chacha-nonce <hex>
    static final org.apache.commons.cli.Option
    OPT_DECRYPT
    Decrypt mode: -d|--decrypt <input>
    static final org.apache.commons.cli.Option
    OPT_DIRECT
    Direct secret: --direct
    static final org.apache.commons.cli.Option
    OPT_ENCRYPT
    Encrypt mode: -e|--encrypt <input>
    static final org.apache.commons.cli.Option
    OPT_HEADER
    Header toggle: --header
    static final org.apache.commons.cli.Option
    OPT_HKDF
    HKDF: --hkdf [infoHex]
    static final org.apache.commons.cli.Option
    OPT_KEM
    KEM id: --kem <id>
    static final org.apache.commons.cli.Option
    OPT_KEY_BYTES
    Derived key bytes: --key-bytes <int>
    static final org.apache.commons.cli.Option
    OPT_KEYRING
    Keyring path: -K|--keyring <file>
    static final org.apache.commons.cli.Option
    OPT_LIST_KEMS
    Discovery: --list-kems
    static final org.apache.commons.cli.Option
    OPT_MAX_KEM_CT
    Max KEM ciphertext len: --max-kem-ct <int>
    static final org.apache.commons.cli.Option
    OPT_OUTPUT
    Output path: -o|--output <file>
    static final org.apache.commons.cli.Option
    OPT_PRIV
    Recipient private alias (decrypt): --priv <alias>
    static final org.apache.commons.cli.Option
    OPT_PUB
    Recipient public alias (encrypt): --pub <alias>

  • Method Summary

    Modifier and Type
    Method
    Description
    static int
    main(String[] args, org.apache.commons.cli.Options opts)
    Executes the KEM command using interactive keyring unlocking.
    static int
    main(String[] args, org.apache.commons.cli.Options opts, KeyringUnlockProvider unlockProvider)
    Executes the KEM command with an explicit keyring unlock source.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • OPT_ENCRYPT

      public static final org.apache.commons.cli.Option OPT_ENCRYPT
      Encrypt mode: -e|--encrypt <input>

    • OPT_DECRYPT

      public static final org.apache.commons.cli.Option OPT_DECRYPT
      Decrypt mode: -d|--decrypt <input>

    • OPT_OUTPUT

      public static final org.apache.commons.cli.Option OPT_OUTPUT
      Output path: -o|--output <file>

    • OPT_KEYRING

      public static final org.apache.commons.cli.Option OPT_KEYRING
      Keyring path: -K|--keyring <file>

    • OPT_PUB

      public static final org.apache.commons.cli.Option OPT_PUB
      Recipient public alias (encrypt): --pub <alias>

    • OPT_PRIV

      public static final org.apache.commons.cli.Option OPT_PRIV
      Recipient private alias (decrypt): --priv <alias>

    • OPT_KEM

      public static final org.apache.commons.cli.Option OPT_KEM
      KEM id: --kem <id>

    • OPT_LIST_KEMS

      public static final org.apache.commons.cli.Option OPT_LIST_KEMS
      Discovery: --list-kems

    • OPT_AES

      public static final org.apache.commons.cli.Option OPT_AES
      Payload switch: --aes

    • OPT_CHACHA

      public static final org.apache.commons.cli.Option OPT_CHACHA
      Payload switch: --chacha

    • OPT_AAD

      public static final org.apache.commons.cli.Option OPT_AAD
      AAD (hex): --aad <hex>

    • OPT_HEADER

      public static final org.apache.commons.cli.Option OPT_HEADER
      Header toggle: --header

    • OPT_HKDF

      public static final org.apache.commons.cli.Option OPT_HKDF
      HKDF: --hkdf [infoHex]

    • OPT_DIRECT

      public static final org.apache.commons.cli.Option OPT_DIRECT
      Direct secret: --direct

    • OPT_KEY_BYTES

      public static final org.apache.commons.cli.Option OPT_KEY_BYTES
      Derived key bytes: --key-bytes <int>

    • OPT_MAX_KEM_CT

      public static final org.apache.commons.cli.Option OPT_MAX_KEM_CT
      Max KEM ciphertext len: --max-kem-ct <int>

    • OPT_AES_CIPHER

      public static final org.apache.commons.cli.Option OPT_AES_CIPHER
      AES mode: --aes-cipher gcm|ctr|cbc

    • OPT_AES_IV

      public static final org.apache.commons.cli.Option OPT_AES_IV
      AES IV: --aes-iv <hex>

    • OPT_AES_TAG_BITS

      public static final org.apache.commons.cli.Option OPT_AES_TAG_BITS
      AES tag bits: --aes-tag-bits <int>

    • OPT_CHACHA_NONCE

      public static final org.apache.commons.cli.Option OPT_CHACHA_NONCE
      ChaCha nonce: --chacha-nonce <hex>

    • OPT_CHACHA_COUNTER

      public static final org.apache.commons.cli.Option OPT_CHACHA_COUNTER
      ChaCha counter value: --chacha-counter <int>

    • OPT_CHACHA_INITIAL

      public static final org.apache.commons.cli.Option OPT_CHACHA_INITIAL
      ChaCha initial counter: --chacha-initial <int>

  • Method Details

    • main

      public static int main(String[] args, org.apache.commons.cli.Options opts) throws org.apache.commons.cli.ParseException, IOException, GeneralSecurityException
      Executes the KEM command using interactive keyring unlocking.
      Parameters:
      args - command arguments
      opts - command options
      Returns:
      process exit code
      Throws:
      org.apache.commons.cli.ParseException - if arguments are invalid
      IOException - if I/O fails
      GeneralSecurityException - if cryptographic processing fails

    • main

      public static int main(String[] args, org.apache.commons.cli.Options opts, KeyringUnlockProvider unlockProvider) throws org.apache.commons.cli.ParseException, IOException, GeneralSecurityException
      Executes the KEM command with an explicit keyring unlock source.
      Parameters:
      args - command arguments
      opts - command options
      unlockProvider - keyring password provider
      Returns:
      process exit code
      Throws:
      org.apache.commons.cli.ParseException - if arguments are invalid
      IOException - if I/O fails
      GeneralSecurityException - if cryptographic processing fails