Cryptographic engineering · Egothor
ZeroEcho
A modular Java cryptographic toolkit for secure, resilient and scriptable data workflows across connected, constrained and offline environments — combining classical and post-quantum cryptography within one extensible engineering model.
Cryptography as a composable system
ZeroEcho is designed around cryptographic workflows rather than a single command or algorithm family. Applications can compose key generation, encryption, signing, verification and recipient handling while keeping algorithm and deployment choices explicit.
The public project combines post-quantum and classical cryptography. Its current capability set includes NIST-standardized ML-KEM alongside established RSA, ECDSA and Ed25519 families, with support for hybrid deployment patterns where migration cannot happen in a single step.
Engineering characteristics
Post-quantum capability
Post-quantum key encapsulation and signatures are treated as practical engineering capabilities rather than isolated demonstrations.
Classical interoperability
Established algorithms remain available so applications can use mature cryptography and adopt post-quantum mechanisms progressively.
Multi-recipient encryption
A single protected payload can be prepared for multiple recipients without requiring one shared secret for the complete group.
Offline survivability
Workflows can be prepared without continuous connectivity and moved through indirect or air-gapped transfer channels.
PKI integration
The project includes a dedicated PKI layer for certificate-oriented workflows rather than leaving public-key infrastructure outside the architecture.
CLI and automation
Command-line tooling exposes the underlying capabilities to scripts and operational workflows without requiring an application integration first.
Security engineering posture
The project is actively maintained and deliberately separates reusable cryptographic capability from higher-level workflow and integration concerns. Recent work has continued to tighten provider handling, PKI behaviour, persistence, signing interoperability and validation boundaries while preserving a modular structure.