The Sfera cryptographic engine is an original implementation of Ukraine's national cryptography suite — written by our engineers over decades, compiled from one source tree to WebAssembly and native ARM64 with byte-exact parity. The core is 224 KB. The entire messenger client built on it is about 430 KB.
These are the cryptographic standards approved in Ukraine for the protection of state information. Our engine implements them from the mathematics up — including the elliptic-curve arithmetic underneath.
| Primitive | Standard | Role |
|---|---|---|
| Kupyna | DSTU 7564 | Hashing, KDF, KMAC, PBKDF2 |
| Kalyna | DSTU 7624 | Authenticated encryption (AEAD) |
| Digital signature | DSTU 4145 | Identity binding, message signing |
| Edwards-curve ECDH | DSTU 9041 | Key agreement; curve mathematics written in-house |
| Double Ratchet | protocol layer | Forward secrecy — a fresh key for every message |
The C core compiles to a 224 KB WASM module that runs the full suite in any modern browser — no Web Crypto fallbacks, no JavaScript crypto.
The same C sources compile natively for iOS and macOS — no emulation layers, no transpiled runtime. Hardware entropy, Secure Enclave integration, full speed.
Every build is verified against golden vectors: fixed inputs must produce identical bytes on every platform, from a single hash to a full encrypted packet on the wire.
Cryptography fails silently — two broken implementations can happily agree with each other. Our answer is independent implementations cross-checked byte-for-byte.
Deterministic test vectors — hashes, KDFs, AEAD ciphertexts, signed packets, backup files — are generated on one platform and must reproduce byte-for-byte on every other. Any drift anywhere in the pipeline turns the build red.
A Swift client and a JavaScript client hold a real conversation through a live relay — Double Ratchet steps, out-of-order delivery, tamper rejection, forward secrecy — proving the implementations agree on the wire, not just in unit tests.
When a second, independent implementation of the same standard produces a different byte, one of them is wrong — and now you know where to look. This discipline has caught subtle defects that a single implementation, agreeing with itself, would never reveal.
The protocol suite is exercised by attacker-perspective tests: replay, tampering, message reordering, key-compromise scenarios. We know how communications are intercepted — so we test like an interceptor.
The mathematics of the Edwards curves and the algorithm implementations in this engine were written over decades by our engineer — work that began in a large Kyiv engineering school building secure-communications equipment and channel-analysis systems for government structures. “Forty years in four hundred kilobytes” is a metaphor — but only barely: the crypto core is 224 KB, and the complete messenger client built on it is about 430 KB.
Licensing. The engine is available for licensing and integration in secure-communications projects — as a compact C core with WebAssembly and native builds, or together with the full protocol layer (Double Ratchet, signed identities, encrypted backup format). Talk to us about your use case.
From a single primitive to a complete secure-messaging stack — the engine is small enough to audit and mature enough to trust with real traffic.
