AEGIS

AEGIS Key-Committed Threshold Architecture: Combining HKDF-SHA256 Domain Separation, GF(2^31-1) Secret Sharing, and Canonical AAD Binding.
46 Automated Unit, RFC 8439/5869 KAT, Adversarial Bit-Flip, and Proptest Property-Based Security Tests Passing with Zero Warnings.

Inspiration & Problem Statement

Cryptographic key management faces a fundamental dilemma: storing a single symmetric key creates a catastrophic single point of failure, while replicating keys across multiple backups multiplies the attack surface. Worse still, naive implementations of Shamir's Secret Sharing (SSS) suffer from unauthenticated secret reconstruction—because any $k$ points define a degree-$(k-1)$ polynomial over a finite field, a single corrupted or maliciously injected share causes Lagrange interpolation to silently output a wrong key without warning.

What It Does

AEGIS solves both problems through a unified, verifiable cryptographic architecture:

CSPRNG Master Key Generation (src/keygen.rs): Samples 256-bit MasterKey buffers directly from the OS kernel CSPRNG (getrandom) with volatile memory scrubbing (ZeroizeOnDrop) and constant-time equality (subtle::ConstantTimeEq).
HKDF-SHA256 Domain-Separated Key Hierarchy (src/kdf.rs): Derives an orthogonal 256-bit EncryptionKey ($K_{\text{enc}}$) and a 256-bit public KeyCommitment ($C_{\text{key}}$) using distinct domain labels.
Custom Prime Finite Field $\mathbb{F}_{2^{31}-1}$ (src/field.rs): Implements exact modular arithmetic over the eighth Mersenne prime $p = 2^{31}-1$ using u64 intermediates (mathematically proving zero overflow since $(p-1)^2 < 2^{62} < 2^{64}-1$), Fermat's Little Theorem multiplicative inverses ($a^{p-2} \bmod p$), Horner's polynomial evaluation, and unbiased 31-bit rejection sampling.
Two-Layer Verifiable Shamir Secret Sharing (src/sss.rs): Splits a 256-bit key into 16 u16 chunks embedded in $\mathbb{F}_{2^{31}-1}$. During Lagrange interpolation at $x=0$, corrupted shares are caught first by an Algebraic Range Trapdoor ($1 - 2^{-240}$ detection probability across 16 chunks) and second by Constant-Time HKDF Commitment Verification ($1 - 2^{-256}$ detection probability).
Key-Committed ChaCha20-Poly1305 AEAD (src/cipher.rs & src/engine.rs): Binds the protocol version, KeyCommitment, and user Associated Data (AAD) into a canonical transcript authenticated by Poly1305, enabling Zero-Exposure Threshold Decryption directly from shares in RAM.

How We Built It (Alignment with Judging Criteria)

Cryptanalysis (3 pts): Verified by 46 automated unit, adversarial bit-flip, RFC 8439/5869 Known-Answer Tests (KAT), and proptest property-based tests, backed by a 10-vector formal Threat Model (docs/SECURITY_ANALYSIS.md).
Uniqueness (2 pts): Clearly separates battle-tested symmetric primitives (ChaCha20-Poly1305, HKDF-SHA256) from our custom $\mathbb{F}_{2^{31}-1}$ threshold algebra, dual-layer verification trapdoor, and canonical AAD commitment binding.
Attack Surface (3 pts): Enforces #![forbid(unsafe_code)], minimal audited dependencies, ZeroizeOnDrop on all secret structs, no Copy trait on keys, subtle::ConstantTimeEq, and oracle-free error reporting.
Mathematical Presentation (2 pts): Accompanied by a 14-section academic LaTeX paper (docs/AEGIS_MATHEMATICAL_PAPER.tex) proving u64 overflow freedom, Fermat's Little Theorem inverses, and Vandermonde matrix invertibility.