recrypt
A pure-Rust library implementing multi-hop Proxy Re-encryption (Transform Encryption) for secure data delegation.
What is recrypt?
Recrypt is a pure-Rust cryptographic library that implements a multi-hop Proxy Re-encryption scheme, known as Transform Encryption. It solves the problem of secure data delegation by allowing ciphertexts encrypted for one user to be transformed so they can be decrypted by another user, without the intermediary ever accessing the plaintext or private keys.
Developers building systems that require secure data sharing, access control, or privacy-preserving data delegation, particularly those working in Rust or WebAssembly environments.
It provides a rigorously audited, production-ready implementation of a collusion-safe, multi-hop Proxy Re-encryption scheme with performance optimizations and memory protection, offering a foundational primitive for building advanced cryptographic applications.
Overview
A set of cryptographic primitives for building a multi-hop Proxy Re-encryption scheme, known as Transform Encryption.
Use Cases
Best For
- Building secure data-sharing platforms with delegated access
- Implementing privacy-preserving access control systems
- Developing cryptographic applications requiring ciphertext transformation
- Creating secure collaboration tools with granular permission delegation
- Adding Proxy Re-encryption capabilities to Rust or WebAssembly projects
- Research and prototyping of advanced cryptographic schemes
Not Ideal For
- Projects requiring only basic symmetric or public-key encryption without delegation capabilities
- Teams needing out-of-the-box, high-level SDKs without implementing cryptographic primitives themselves
- Applications in environments with strict AGPL compliance issues or patent avoidance requirements
- High-throughput, real-time systems where millisecond-level cryptographic operations are too slow
Pros & Cons
Pros
The library has been formally audited by NCC Group, confirming cryptographic correctness and resistance to side-channel attacks, as noted in the README.
Automatically uses mlock on supported platforms to prevent sensitive data from swapping to disk, with an option to disable it via feature flags.
Includes a dedicated u32_backend and wasm feature flag for compiling to WebAssembly, enabling secure use in browser-based applications.
Supports chained transformations for flexible access control, allowing delegatees to further delegate decryption rights, as highlighted in the key features.
Cons
Requires careful selection of feature flags (e.g., u64_backend vs u32_backend) for different targets, and misconfiguration can lead to compile errors, adding setup overhead.
Benchmarks show operations like transform key generation and transformations take milliseconds, which may be too slow for latency-critical applications.
The AGPL license and associated patents could limit commercial use without a paid license, introducing legal and compliance hurdles for some projects.
Frequently Asked Questions
Related Projects
rustlsA modern TLS library in Rust
BLAKE3the official Rust and C implementations of the BLAKE3 cryptographic hash function
OckamOrchestrate end-to-end encryption, cryptographic identities, mutual authentication, and authorization policies between distributed applications – at massive scale.
ringAn experiment.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.