ZeroEcho API

ZeroEcho Library

ZeroEcho is a layered cryptography library delivered as the lib module. It exposes a minimal core of cryptographic primitives and a higher-level SDK of composition tools. The design favors clear separation of responsibilities, safe defaults, and extensibility for future algorithms and pipelines.

Table of registered cryptographic algorithms with grouped columns for families and key usages.

Registered cryptographic algorithms
Algorithm IDDisplay NameFamilyKey usageParameter sets
AGREEMENTASYMMETRICDIGESTKEMSYMMETRICAGREEMENTDECAPSULATEDECRYPTDIGESTENCAPSULATEENCRYPTMACSIGNVERIFY
AESAES (CBC/GCM/CTR)✓✓✓
AES-128 128-bit
AES-192 192-bit
AES-256 256-bit
BIKEBIKE✓✓✓✓✓
BIKE-128 L1 / 128-bit
BIKE-192 L3 / 192-bit
BIKE-256 L5 / 256-bit
CHACHA20ChaCha20 (stream)✓✓✓
ChaCha20-256 256-bit
CHACHA20-POLY1305ChaCha20-Poly1305 (AEAD)✓✓✓—
CMCEClassic McEliece (CMCE)✓✓✓✓✓
CMCE-460896 192-bit
CMCE-460896F 192-bit
CMCE-6688128 256-bit
CMCE-6688128F 256-bit
CMCE-6960119 256-bit
CMCE-6960119F 256-bit
CMCE-8192128 256-bit
CMCE-8192128F 256-bit
DHDH✓✓
FFDHE-2048 112-bit
FFDHE-3072 128-bit
FFDHE-4096 140-bit
FFDHE-6144 152-bit
FFDHE-8192 192-bit
DIGESTSHA-2/SHA-3/SHAKE✓✓—
ECDHECDH✓✓
ECDH-P256 128-bit
ECDH-P384 192-bit
ECDH-P521 256-bit
ECDSAECDSA✓✓✓
ECDSA-P256 128-bit
ECDSA-P384 192-bit
ECDSA-P521 256-bit
Ed25519Ed25519✓✓✓
Ed25519 128-bit
Ed448Ed448✓✓✓
Ed448 224-bit
ElGamalElGamal✓✓✓
ElGamal-2048 112-bit
FrodoFrodoKEM✓✓✓✓✓
FrodoKEM-976-AES 192-bit
FrodoKEM-976-SHAKE 192-bit
FrodoKEM-1344-AES 256-bit
FrodoKEM-1344-SHAKE 256-bit
HMACHMAC (generic)✓✓
HMAC-SHA256 256-bit
HMAC-SHA384 384-bit
HMAC-SHA512 512-bit
hmac-custom template(macName: String, keySizeBits: Integer)
HQCHQC✓✓✓✓✓
HQC-128 L1 / 128-bit
HQC-192 L3 / 192-bit
HQC-256 L5 / 256-bit
LMSLMS✓✓
LMS 128-bit
ML-DSAMLDSA✓✓✓
ML-DSA-44 L2 / 128-bit
ML-DSA-65 L3 / 192-bit
ML-DSA-87 L5 / 256-bit
ML-KEMKyber (ML-KEM)✓✓✓✓✓
ML-KEM-512 L1 / 128-bit
ML-KEM-768 L3 / 192-bit
ML-KEM-1024 L5 / 256-bit
NTRUNTRU (KEM)✓✓✓✓✓
NTRU-HPS-2048-509 128-bit
NTRU-HPS-2048-677 192-bit
NTRU-HPS-4096-821 192-bit
NTRU-HPS-4096-1229 256-bit
NTRU-HRSS-701 128-bit
NTRU-HRSS-1373 256-bit
NTRULPRimeNTRU LPRime✓✓✓✓✓
NTRULPR653 128-bit
NTRULPR761 128-bit
NTRULPR857 192-bit
NTRULPR953 192-bit
NTRULPR1013 192-bit
NTRULPR1277 256-bit
RSARSA✓✓✓✓✓
RSA-2048 112-bit
RSA-3072 128-bit
RSA-4096 140-bit
rsa-custom template(keySizeBits: Integer, publicExponent: Integer)
SABERSABER✓✓✓✓✓
LightSaber-128 128-bit
Saber-128 128-bit
FireSaber-128 128-bit
LightSaber-192 192-bit
Saber-192 192-bit
FireSaber-192 192-bit
LightSaber-256 256-bit
Saber-256 256-bit
FireSaber-256 256-bit
SLH-DSASLHDSA✓✓✓
SLH-DSA-SHA2-128f L1 / 128-bit
SLH-DSA-SHA2-128s L1 / 128-bit
SLH-DSA-SHA2-192f L3 / 192-bit
SLH-DSA-SHA2-192s L3 / 192-bit
SLH-DSA-SHA2-256f L5 / 256-bit
SLH-DSA-SHA2-256s L5 / 256-bit
SLH-DSA-SHAKE-128f L1 / 128-bit
SLH-DSA-SHAKE-128s L1 / 128-bit
SLH-DSA-SHAKE-192f L3 / 192-bit
SLH-DSA-SHAKE-192s L3 / 192-bit
SLH-DSA-SHAKE-256f L5 / 256-bit
SLH-DSA-SHAKE-256s L5 / 256-bit
SNTRUPrimeSNTRU Prime✓✓✓✓✓
SNTRUP653 128-bit
SNTRUP761 128-bit
SNTRUP857 192-bit
SNTRUP953 192-bit
SNTRUP1013 192-bit
SNTRUP1277 256-bit
SPHINCS+SPHINCSPLUS✓✓✓
SPHINCS+-SHA2-128f L1 / 128-bit
SPHINCS+-SHA2-128s L1 / 128-bit
SPHINCS+-SHA2-192f L3 / 192-bit
SPHINCS+-SHA2-192s L3 / 192-bit
SPHINCS+-SHA2-256f L5 / 256-bit
SPHINCS+-SHA2-256s L5 / 256-bit
SPHINCS+-SHAKE-128f L1 / 128-bit
SPHINCS+-SHAKE-128s L1 / 128-bit
SPHINCS+-SHAKE-192f L3 / 192-bit
SPHINCS+-SHAKE-192s L3 / 192-bit
SPHINCS+-SHAKE-256f L5 / 256-bit
SPHINCS+-SHAKE-256s L5 / 256-bit
X-WingX-Wing✓✓✓✓✓
X-Wing L3 / 192-bit
XMSSXMSS✓✓
XMSS 128-bit
XdhXdh✓✓
X25519 128-bit
X448 224-bit

Layering

  • Core (zeroecho.core): low-level cryptographic engine. This includes algorithm definitions, stateful contexts, registry and metadata, specification and SPI contracts, and selected helpers required by algorithms (e.g., I/O, marshalling, tagging, auditing, policies).
  • SDK (zeroecho.sdk): developer-facing composition layer built on the core. It provides content abstractions, fluent builders (both generic and per-algorithm), utilities for multi-recipient or composed flows, and supporting helpers used by those builders.

Package map (lib)

  • zeroecho.core
    • alg: concrete algorithms and small shared helpers used by algorithms.
    • context: stateful operation interfaces (encryption, signatures, digests, MAC, agreement, KEM, and related variants).
    • spec / spi: specification objects and construction/factory contracts.
    • policy / audit / err / annotation: cross-cutting concerns within the core.
    • io / marshal / tag: helpers used by algorithms and contexts at runtime.
    • (root): provider/registry surface and core metadata.
  • zeroecho.sdk
    • content: content abstractions, basic implementations, and export facilities.
    • builders: composition APIs, including generic builders and per-algorithm builders.
    • guard: utilities for multi-recipient and other composed workflows.
    • io / logging: supporting helpers used by the SDK layer and applications.

Design principles

  • Stratification: the core remains focused on algorithms and correctness; the SDK focuses on developer ergonomics and composition.
  • Composability: data flows are constructed through builders and content abstractions with predictable, chainable behavior.
  • Extensibility: new algorithms, formats, and flows can be added with minimal impact on existing code.
  • Safety: role-based binding and policy checks promote safe defaults and clear intent.

Intended use

Third-party applications depend on the lib module. Most integrations work at the SDK layer to compose data pipelines, while the core layer provides the cryptographic foundation and guarantees. The project’s structure and documentation aim to make entry points, responsibilities, and extension points explicit.

Modules
Module
Description
zeroecho.lib
ZeroEcho foundation library: cryptographic core (zeroecho.core) and the high-level SDK (zeroecho.sdk) kept together in one artifact/module.