Announcing securebit_core: A Platform-Agnostic Cryptographic Kernel for Secure P2P Communication

Note: Before publishing, replace all instances of YOUR_USERNAME with your actual GitHub username.

Published: December 23, 2025
Tags: #rust #cryptography #webrtc #security #p2p #opensource

🚀 Introduction

Today, I'm excited to announce the public release of securebit_core — a pure Rust cryptographic kernel designed for secure peer-to-peer communication. After months of development and security auditing, we're opening it up to the community for review, collaboration, and adoption.

🎯 What is securebit_core?

securebit_core is a platform-agnostic cryptographic library that provides the security-critical primitives for building secure WebRTC-based peer-to-peer applications. Think of it as the cryptographic "engine" that powers secure communication — completely independent of UI frameworks, desktop environments, or mobile platforms.

Key Characteristics

✅ Zero Platform Dependencies: No Tauri, no UI frameworks, no OS-specific APIs
✅ Cross-Platform: Works on Windows, macOS, Linux, Android, iOS
✅ Headless: Can be used in CLI tools, daemons, and background services
✅ Thread-Safe: Built with Arc<Mutex<>> for concurrent access
✅ Security-First: All security-critical code is public and auditable

🔐 Security Features

Cryptographic Primitives

The core implements industry-standard cryptographic algorithms:

ECDH Key Exchange (P-384): Ephemeral key exchange with perfect forward secrecy
ECDSA Signatures (P-384): Cryptographic authentication of protocol messages
HKDF Key Derivation (SHA-256): Deterministic key derivation from shared secrets
AES-256-GCM Encryption: Authenticated encryption for message confidentiality and integrity
HMAC-SHA-256: Message authentication codes for integrity verification
SAS (Short Authentication String): MITM detection via DTLS fingerprint verification

Protocol Security

Protocol Version Enforcement: Strict validation of protocol version (v4.0)
Message Structure Validation: All protocol messages are validated before processing
State Machine Integrity: Connection state transitions are enforced
Replay Protection: Sequence numbers prevent message replay attacks
Metadata Protection: Message metadata (timestamps, IDs) are encrypted separately

🏗️ Architecture

The core is designed as a single source of truth for all security-critical operations. This means:

All cryptographic logic is in the public core — no hidden security code
Adapters are thin wrappers — they cannot weaken security guarantees
Platform-independent — same security behavior across all platforms

Project Structure

securebit_core/
├── src/
│   ├── core.rs          # Main Core struct and public API
│   ├── crypto.rs        # Cryptographic utilities (AES-256-GCM)
│   ├── session.rs       # Session management (encryption/decryption)
│   ├── webrtc.rs        # WebRTC protocol (offer/answer/join)
│   ├── error.rs         # Error types
│   └── logger.rs        # Optional logging trait
├── SECURITY_MODEL.md    # Security guarantees and boundaries
├── THREAT_MODEL.md      # Threats mitigated and not mitigated
└── README.md            # Complete documentation

💻 Quick Start

Installation

Add to your Cargo.toml:

[dependencies]
securebit_core = { git = "https://github.com/YOUR_USERNAME/securebit_core" }
# Or when published to crates.io:
# securebit_core = "0.1.0"

Basic Usage

use securebit_core::Core;

// Create a new Core instance
let core = Core::new();

// Create a secure offer (for initiator)
let offer = core.create_secure_offer(Some(web_rtc_sdp))?;
println!("Offer: {}", offer);

// Join a connection (for responder)
let answer = core.join_secure_connection(offer_data, Some(web_rtc_answer_sdp))?;

// Handle answer (for initiator)
let result = core.handle_secure_answer(answer_data)?;

// Encrypt a message
let encrypted = core.encrypt_enhanced_message(
    "Hello, world!".to_string(),
    "msg-123".to_string(),
    1
)?;

// Decrypt a message
let decrypted = core.decrypt_enhanced_message(encrypted)?;

Integration with Tauri

use securebit_core::Core;
use std::sync::Arc;
use tauri::{State, Manager};

#[tauri::command]
fn create_secure_offer(
    core: State<Arc<Core>>,
    offer_sdp: Option<String>
) -> Result<String, String> {
    core.create_secure_offer(offer_sdp)
}

🌐 Use Cases

Desktop Applications (Tauri)

Perfect for building secure desktop chat applications with Tauri. The core handles all cryptographic operations, while your UI focuses on user experience.

Mobile Applications

Use the core in native mobile apps (iOS, Android) via FFI bindings. The same security guarantees apply across all platforms.

CLI Tools

Build secure command-line tools for peer-to-peer communication, file sharing, or secure messaging.

Background Services

Run the core in headless daemons or background services where security is critical but UI is not needed.

🔍 Security Transparency

One of our core principles is security transparency. We believe that:

✅ All security-critical code should be public and auditable
✅ Security should not rely on obscurity
✅ Independent security researchers should be able to review everything

What We Guarantee

The core provides strong cryptographic and protocol security guarantees:

Cryptographic Security: ECDH, ECDSA, HKDF, AES-GCM, HMAC
Protocol Security: Version enforcement, message validation, state machine
Key Management: Ephemeral keys, secure derivation, key isolation
SAS Security: Deterministic SAS computation for MITM detection
Input Validation: Strict validation of all inputs

What We Don't Guarantee

We're transparent about limitations:

❌ Platform Security: Protection against compromised OS/hardware
❌ Network Security: Protection against network-level attacks
❌ UI Security: Protection against malicious UI code
❌ Side-Channel Attacks: Protection against timing/power/cache attacks

See our SECURITY_MODEL.md and THREAT_MODEL.md for detailed analysis.

🛡️ Why Platform-Agnostic?

Traditional security libraries are often tied to specific platforms or frameworks. This creates several problems:

Code Duplication: Security logic must be reimplemented for each platform
Inconsistency: Different platforms may have subtle security differences
Maintenance Burden: Security fixes must be applied to multiple codebases
Audit Complexity: Security researchers must review multiple implementations

securebit_core solves this by providing a single, platform-independent implementation that can be used everywhere. This means:

✅ One codebase to audit — security researchers can review everything in one place
✅ Consistent security — same cryptographic behavior across all platforms
✅ Easier maintenance — security fixes apply to all platforms automatically
✅ White-label ready — partners can verify security independently

📊 Code Quality

Build Status

✅ Zero compiler warnings
✅ Zero compiler errors
✅ All tests passing
✅ No unsafe code
✅ Comprehensive error handling

Dependencies

We use well-vetted cryptographic libraries from the RustCrypto ecosystem:

p384: P-384 elliptic curve (ECDH, ECDSA)
aes-gcm: AES-256-GCM authenticated encryption
hkdf: HKDF key derivation (SHA-256)
hmac: HMAC-SHA-256 message authentication
sha2: SHA-256, SHA-384 hashing

No platform-specific dependencies — the core is truly platform-agnostic.

🎓 Learning Resources

Documentation

README.md: Complete API reference and usage examples
SECURITY_MODEL.md: Detailed security guarantees and boundaries
THREAT_MODEL.md: Comprehensive threat analysis

Example Integrations

We're working on example integrations for:

Tauri desktop applications
Native mobile apps (iOS/Android)
CLI tools
Background services

🤝 Contributing

This is a security-critical crate. We welcome contributions, but all changes must:

Maintain platform independence (no platform-specific code)
Preserve security guarantees (no weakening of security)
Follow Rust security best practices (no unsafe, proper error handling)
Include tests for new functionality
Update documentation (README, SECURITY_MODEL, THREAT_MODEL)

🔬 Security Audits

We're actively seeking independent security audits. If you're a security researcher interested in reviewing the codebase, please:

Review the SECURITY_MODEL.md to understand our security guarantees
Review the THREAT_MODEL.md to understand what we mitigate
Open an issue or contact us directly

📦 License

This project is licensed under the Apache License, Version 2.0 — see the LICENSE file for details.

🚀 What's Next?

Immediate Goals

✅ Public release on GitHub
✅ Security audit by independent researchers
✅ Community feedback and contributions

Future Plans

📦 Publish to crates.io
📚 Expand documentation and examples
🔧 Add more integration examples
🧪 Expand test coverage
⚡ Performance optimizations

🙏 Acknowledgments

Built with Rust's excellent cryptographic ecosystem
Designed for independent security review and white-label distribution
Inspired by Signal Protocol and OTR (Off-the-Record) messaging

📞 Get Involved

GitHub: github.com/YOUR_USERNAME/securebit_core
Issues: Report bugs or request features
Discussions: Ask questions or share ideas
Security: Report security issues responsibly

💡 Why This Matters

In an era where secure communication is more important than ever, having a transparent, auditable, and platform-independent cryptographic kernel is crucial. securebit_core provides exactly that — a foundation you can trust, verify, and build upon.

Whether you're building:

🔒 Secure messaging applications
📁 Peer-to-peer file sharing
🎮 Secure multiplayer games
💼 Enterprise communication tools
🌐 Any application requiring secure P2P communication

securebit_core gives you the cryptographic primitives you need, with the transparency and auditability you deserve.

Try it out, review the code, and let us know what you think! 🚀

Published on December 23, 2025
Tags: #rust #cryptography #webrtc #security #p2p #opensource

FilesExpand file tree

DEVTO_ARTICLE.md

Latest commit

History