Ombracrypt

The zero-trust quantum vault for cross-platform data sovereignty.

Overview & Features

Ombracrypt is a network-isolated, cross-platform Post-Quantum Cryptographic (PQC) file encryption utility dedicated to securing digital assets. It is explicitly designed to defend against future quantum computing-based cyberattacks, ensuring absolute data privacy without relying on external infrastructure or cloud services. The application combines an intuitive interface with a high-performance cryptographic engine.

• Cross-Platform: Native installers generated via automated CI/CD for Linux, Windows, and macOS.
• Network-isolated Execution: No telemetry, no cloud accounts, and no internet connection required.
• Modern Cryptography: Utilizes NIST-standard file encryption algorithms validated through CAVP and CMVP.
• Hybrid KEM Architecture: Employs a hybrid Key Encapsulation Mechanism (KEM) that combines traditional cryptography with Post-Quantum Cryptography (PQC) to provide enhanced encryption.

Security & Threat Model

Transparency is paramount in cryptographic tooling. Ombracrypt is strictly designed to secure data at rest against modern and future threats, but it operates under the assumption that the host environment itself is secure.

In Scope:

• Post-Quantum Resilience: Protecting Ombracrypt Vaults (.obv) stored on untrusted public clouds or shared media against "Store Now, Decrypt Later" (SNDL) attacks utilizing quantum computing.
• Cryptographic Agility: Offering a modular selection of symmetric ciphers and Key Encapsulation Mechanisms (KEMs), empowering users to calibrate the trade-off between cryptographic strength and processing overhead.
• Secure Bundling: Consolidating multiple heterogeneous files into a single encrypted .obv vault for streamlined, organized data management.
• Physical & Local Security: Mitigating unauthorized local access and protecting payloads against the physical theft of offline storage devices.
• Supply Chain Integrity: Ensuring transparent, verifiable release binaries through automated GitHub Actions CI/CD
• Anti-Coercion (Deception Passcode): Mitigating physical duress via a secondary passcode that mimics a successful unlock, but silently destroys the Ombracrypt Key (.obk) to ensure plausible deniability.

Out of Scope:

• Endpoint Compromise: Defending against active keyloggers, memory scraping, screen-recording malware, or inherently compromised host operating systems.
• Data Recovery: Retrieving encrypted payloads if the master passphrase is forgotten or the Ombracrypt Key (.obk) file is permanently lost. Our zero-knowledge architecture means there are absolutely no backdoors.

Core Architecture and Cryptanalysis (v0.3.3)

• Chunked Streaming Engine: Ombracrypt utilizes a strict 1MB chunked streaming architecture, enabling the encryption of massive payloads while maintaining a near-zero RAM footprint.
• Hardware-Level Failsafes: Engineered with strict OS-level error trapping, the engine intercepts hardware limitations (such as disk storage exhaustion) and executes secure cleanup protocols to prevent data corruption.
• 100% Edge-Case Validated: The processing pipeline is natively designed to handle structural anomalies, including zero-byte directories and strict filesystem permission walls.

Documentation

For a comprehensive understanding of Ombracrypt's operation, engineering, and cryptographic proofs, please refer to our dedicated documentation files:

• Quick Start Guide: Visual, step-by-step instructions for encrypting and decrypting your first vault.
• System Architecture: A detailed breakdown of the Tauri/Rust isolation, the IPC bridge, and the memory-safe streaming engine.
• Cryptographic Threat Model: In-depth cryptanalysis, entropy proofs, and the complete Post-Quantum Key Encapsulation pipeline.

Download &Installation

Download the latest stable release from our Releases Page.

• Linux (Debian-based distributions): Download and install the .deb package.
• Linux (Red Hat-based distributions): Download and install the .rpm package.
• Windows: Download and run the .exe or .msi setup file.
• macOS: Mount the .dmg image or extract the .app.tar.gz archive.

To secure your data, first organize your target files into a single directory. Launch Ombracrypt, select this directory via the interface, choose your preferred cryptographic algorithms, and set a strong Master Password (and an optional Deception Passcode). The engine will process the folder and output a Quantum-Safe Vault (.obv) and a corresponding Ombracrypt Key (.obk).

To restore your files, select your .obv vault and .obk key file, input your master passphrase, and initiate the decryption process.

Best Practices

• **Passphrase Management:**Either completely memorize your master passphrase, or store it in a secure, offline password manager. Never store passphrases in plain text.
• Separation of Assets: Always store your Ombracrypt Key (.obk) in a physically and logically separate location from your encrypted Ombracrypt Vault (.obv) to prevent a single-point-of-failure compromise.
• Data Verification: Verify that the encryption process completed successfully and that you can decrypt the vault before permanently deleting or wiping the original, unencrypted source files.

Author & Contributors

• Abhishek Biswas – Lead Maintainer – @ABiswasDev

License

Ombracrypt is open-source and licensed under the AGPL-3.0 License. We welcome code reviews, audits, and contributions to ensure the highest standard of security.

Developer Guide: Building from Source

Ombracrypt utilizes a Tauri architecture, bridging a lightweight web frontend with a high-performance Rust cryptographic core. If you wish to audit the code, contribute, or compile the application locally, follow these steps.

1. Prerequisites Ensure your development environment has the following core tools installed:

• Git
• Node.js (v18 or higher)
• Rust & Cargo (latest stable toolchain)

Platform-Specific Dependencies:

• Windows: You must install the Microsoft C++ Build Tools. During the installer setup, ensure the "Desktop development with C++" workload is selected. (Note: Windows 10 users may also need to install the WebView2 runtime; it is pre-installed on Windows 11).
• macOS: You must install the Xcode Command Line Tools to compile the C and Rust dependencies. Open your terminal and run:

  xcode-select --install

• Linux (Debian/Ubuntu/Mint): You must install the WebKit and GTK packages required by Tauri. Open your terminal and run:

  sudo apt update
  sudo apt install libwebkit2gtk-4.1-dev build-essential curl wget file libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev

2. Local Setup & Execution

# Clone the repository
git clone [https://github.com/ABiswasDev/Ombracrypt.git](https://github.com/ABiswasDev/Ombracrypt.git)
cd Ombracrypt

# Install frontend dependencies
npm install

# Launch the application in development mode (with hot-reloading)
npm run tauri dev

3. Building for Production To build the optimized release binaries for your current operating system, run: npm run tauri build

The compiled installation files will be generated inside the src-tauri/target/release/bundle/ directory.

4. Contribution & Automated CI/CD Releases Ombracrypt uses a GitHub Actions CI/CD pipeline to automatically compile, sign, and draft cross-platform releases for Windows, macOS, and Linux.

For Contributors (Standard Flow):

# 1. Create a feature branch
git checkout -b feature/your-feature-name

# 2. Commit your changes with a descriptive message
git add .
git commit -m "feat: added new cipher UI"

# 3. Push and open a Pull Request on GitHub
git push origin feature/your-feature-name

For Maintainers (Triggering the Pipeline): The automated release script is triggered by pushing a version tag to the main branch.

# Pushing a new version tag runs the CI/CD pipeline
git tag v0.2.4
git push origin v0.2.4