🔰 KryptonShield

简体中文 | English

A Personal Data Fortress for the Supercomputing Era — Brute-Force Resistant Encryption Powered by Argon2 + AES-256-GCM

---

📑 Table of Contents

• 📖 Introduction
• ✨ Core Features
• 🔧 Technical Principles
  • 1. Key Derivation — Argon2id
  • 2. Symmetric Encryption — AES-256-GCM
  • 3. Encrypted Data Structure
• 🚀 Quick Start
• 📚 Usage Examples
• ⚙️ Advanced Configuration
• 🛡️ Security Considerations & Disclaimer
• 📄 Open Source License
• 🤝 Contributing & Feedback

---

📖 Introduction

KryptonShield is an open-source, offline encryption tool designed to protect personal files and folders against brute-force attacks from commodity supercomputers and GPU clusters. Built upon public cryptographic standards, its primary objective is to offer robust data protection for sensitive personal information.

Unlike standard ZIP encryption or simple AES implementations, KryptonShield employs the memory-hard key derivation function Argon2id. By mandating substantial memory and computational resources for each decryption attempt, it renders large-scale parallel password guessing economically and technically prohibitive for adversaries using low-cost hardware.

---

✨ Core Features

Feature	Description
🔐 Military-Grade Encryption	Utilizes AES-256-GCM authenticated encryption, ensuring confidentiality, integrity, and tamper-resistance simultaneously.
🧠 Memory-Hard Brute-Force Resistance	Key derivation leverages the Argon2id algorithm with a default memory cost of 512 MiB, effectively neutralizing attacks from GPU/ASIC/FPGA cracking farms.
📁 One-Click Folder Encryption	Automatically archives entire directories into ZIP format before encryption, and intelligently restores the folder structure upon decryption.
🌐 Completely Offline	No network dependencies, no data collection, and no backdoors. The password is the sole credential.
⚙️ Tunable Security Parameters	Advanced users can adjust Argon2 time and memory costs to balance security requirements with system performance.

---

🔧 Technical Principles

1. Key Derivation — Argon2id

Argon2 is the winner of the 2015 Password Hashing Competition (PHC) and is widely recognized as the state-of-the-art password hashing / key derivation function. This tool utilizes the Argon2id variant, which combines resistance against side-channel attacks and time-memory trade-off (TMTO) attacks.

Default Parameters:

Parameter	Value	Description
Time Cost	4	Number of iterations, controlling computational load
Memory Cost	512 MiB	Critical parameter, forces high memory usage
Parallelism	2	Number of parallel threads
Salt Length	16 bytes	Randomly generated, prevents rainbow table attacks
Output Length	32 bytes	Hashed again with SHA256 to form the AES key

2. Symmetric Encryption — AES-256-GCM

• AES-256: 256-bit key length, approved for U.S. Government Top Secret information.
• GCM Mode: Galois/Counter Mode, an Authenticated Encryption with Associated Data (AEAD) scheme. It generates an authentication tag during encryption; any modification to the ciphertext will cause decryption verification to fail and raise an exception.

3. Encrypted Data Structure

The internal binary layout of every encrypted file (.enc / .zip.enc) is as follows:

+----------------+----------------+----------------+----------------------+
|      Salt      |     Nonce      |      Tag       |      Ciphertext      |
|   (16 bytes)   |   (12 bytes)   |   (16 bytes)   |      (Variable)      |
+----------------+----------------+----------------+----------------------+

• Salt: Random salt used for Argon2 key derivation.
• Nonce: Initialization vector for AES-GCM, randomly generated per encryption.
• Tag: Authentication tag generated by GCM mode for integrity verification.
• Ciphertext: Encrypted form of the original plaintext data.

---

🚀 Quick Start

Requirements

• Python 3.7 or higher
• pip package manager

Install Dependencies

pip install argon2-cffi pycryptodome

Download Source Code

Download secure_encrypt.py to your local machine, or copy the code directly.

Run the Program

python secure_encrypt.py

Upon execution, an interactive menu will appear:

======================================================================
          High-Security File/Folder Encryption Tool (Argon2 + AES-256-GCM)
======================================================================
Please select an operation:
  1. Encrypt a single file
  2. Decrypt a file (auto-detect and extract folders)
  3. Encrypt an entire folder (auto-pack to ZIP)
======================================================================
Enter option (1/2/3):

---

📚 Usage Examples

Scenario 1: Encrypt a Single File

Enter option (1/2/3): 1
Enter the file path to encrypt: /path/to/secret.docx
Enter encryption password: ********
Re-enter encryption password: ********
Output path for encrypted file (press Enter to add .enc suffix): 
✅ File encrypted successfully! Saved to: /path/to/secret.docx.enc

Scenario 2: Decrypt a File

Enter option (1/2/3): 2
Enter the file path to decrypt: /path/to/secret.docx.enc
Enter decryption password: ********
Output path for decrypted file (press Enter for auto-handling): 
✅ Decryption successful! Result located at: /path/to/secret.docx

If the decrypted content is a ZIP archive (produced by folder encryption), the program will prompt:

Detected that the decrypted file is a ZIP archive: /path/to/secret.docx
Extract to a folder? (y/n): y
Enter target extraction directory (press Enter to use the filename): 
Extracted to folder: /path/to/secret
Delete the decrypted ZIP file? (y/n): y
Deleted: /path/to/secret.docx
✅ Decryption successful! Result located at: /path/to/secret

Scenario 3: Encrypt an Entire Folder

Enter option (1/2/3): 3
Enter the folder path to encrypt: /path/to/my_project
Enter encryption password: ********
Re-enter encryption password: ********
Output path for encrypted file (press Enter to generate [folder_name].zip.enc): 
✅ Folder encrypted successfully! Saved to: /path/to/my_project.zip.enc

---

⚙️ Advanced Configuration

Users with specific security requirements can modify the parameters at the beginning of kryptonshield.py:

# --- Configuration Parameters (Adjust According to Security Needs) ---
KEY_LENGTH = 32
ARGON2_TIME_COST = 4          # Iterations; increasing raises resistance to computational attacks
ARGON2_MEMORY_COST = 512 * 1024 # Memory cost (512 MB); increasing significantly raises GPU/ASIC attack resistance
ARGON2_PARALLELISM = 2        # Degree of parallelism
ARGON2_HASH_LEN = 32
ARGON2_SALT_LEN = 16

Parameter Adjustment	Impact on Legitimate Users	Impact on Attackers
Increase MEMORY_COST	More memory usage and slower encryption/decryption	Cracking rigs require larger VRAM/RAM, exponentially increasing cost
Increase TIME_COST	Encryption/decryption time increases linearly	Time per password guess increases linearly
Decrease parameters	Improves performance on low-spec devices	Weakens resistance to brute-force; use with caution

⚠️ Note: Files encrypted with modified parameters can only be decrypted by a program using the same parameters. It is recommended to settle on a fixed set of parameters for long-term use.

---

🛡️ Security Considerations & Disclaimer

Password Security

• The password is the sole credential. This tool does not store any passwords or recovery keys. If the password is forgotten, the encrypted data is irrecoverable forever.
• It is strongly recommended to use a high-entropy password (e.g., a randomly generated string of 12+ mixed characters) and store it in a password manager.

Usage Limitations

• This tool is intended solely for legitimate personal data protection. Any illegal usage is strictly prohibited.
• Handle encrypted files with care; corruption (e.g., transmission errors, bad sectors) may lead to permanent data loss.

Threat Model

• Effective Against: Offline brute-force attacks launched by commodity supercomputing clusters, GPU cracking farms, and specialized ASIC hardware.
• Not Effective Against: Keyloggers, memory scraping, cold boot attacks, social engineering, legal coercion, and other non-cryptographic attack vectors.

Legal Notice

Users must comply with the laws and regulations of their respective jurisdictions. The developer assumes no liability for any misuse of this tool.

---

📄 Open Source License

This project is licensed under the MIT License. You are free to use, modify, and distribute it.

---

🤝 Contributing & Feedback

For questions, suggestions, or security vulnerability reports, please contact:

• Submit a GitHub Issue

---

— KryptonShield: Forging a cryptographic barrier that even supercomputers struggle to breach. —