The Sfera cryptographic engine is an original implementation of Ukraine's national cryptography suite — written by our engineers over decades, compiled from one source tree to WebAssembly and native ARM64 with byte-exact parity. The core is 229 KB.
These are the cryptographic standards approved in Ukraine for the protection of state information. Our engine implements them from the ground up — including the elliptic-curve arithmetic underneath.
| Primitive | Standard | Role |
|---|---|---|
| Kupyna | DSTU 7564 | Hashing, KDF, KMAC |
| Argon2id | RFC 9106 | Memory-hard master-password sealing |
| Kalyna | DSTU 7624 | Authenticated encryption (AEAD) |
| Digital signature | DSTU 4145 (M257_PB) | Identity binding, message signing |
| Edwards-curve ECDH | DSTU 9041 (E512/1) | Key agreement: our own from-scratch implementation of the E512/1 standard curve |
| Double Ratchet | protocol layer | Forward secrecy — a fresh key for every message |
The C core compiles to a 229 KB WASM module that runs the full suite in any modern browser — no Web Crypto fallbacks, no JavaScript crypto.
The same C sources compile natively for iOS and macOS — no emulation layers, no transpiled runtime. Hardware entropy, Secure Enclave integration, full speed.
Every build is verified against golden vectors: fixed inputs must produce identical bytes on every platform, from a single hash to a full encrypted packet on the wire.
Cryptography fails silently — two broken implementations can happily agree with each other. Our answer is independent implementations cross-checked byte-for-byte.
Deterministic test vectors — hashes, KDFs, AEAD ciphertexts, signed packets, backup files — are generated on one platform and must reproduce byte-for-byte on every other. Any drift anywhere in the pipeline turns the build red.
A Swift client and a JavaScript client hold a real conversation through a live relay — Double Ratchet steps, out-of-order delivery, tamper rejection, forward secrecy — proving the implementations agree on the wire, not just in unit tests.
When a second, independent implementation of the same standard produces a different byte, one of them is wrong — and now you know where to look. This discipline has caught subtle defects that a single implementation, agreeing with itself, would never reveal.
The protocol suite is exercised by attacker-perspective tests: replay, tampering, message reordering, key-compromise scenarios. We know how communications are intercepted — so we test like an interceptor.
The Edwards-curve arithmetic and the algorithm implementations in this engine were built over decades by our engineers — work that began in a large Kyiv engineering school building secure-communications equipment and channel-analysis systems for government structures. “Forty years in four hundred kilobytes” is a metaphor — but only barely: the crypto core is 229 KB.
Licensing. The engine is available for licensing and integration in secure-communications projects — as a compact C core with WebAssembly and native builds, or together with the full protocol layer (Double Ratchet, signed identities, encrypted backup format). Talk to us about your use case.
From a single primitive to a complete secure-messaging stack — the engine is small enough to audit and mature enough to trust with real traffic.
