SCARF (SCARLETT Cryptography Framework) is a low-level C11 cryptographic foundation for future applications such as SC1. SC1 is intentionally outside this repository.
The initial codebase provides initialization and cleanup, stable error codes, a portable secure-memory abstraction, an opaque sensitive-key object, a provider registry and dispatch layer, OS-backed secure random generation, and SHA-256 through the built-in C provider. SHA-256 uses standardized FIPS 180-4 construction and test vectors.
The libsodium provider supplies Argon2id and XChaCha20-Poly1305 when libsodium is available. Without it, those operations return SCARF_ERROR_UNSUPPORTED; there is no insecure fallback. Argon2id currently accepts parallelism == 1, because libsodium exposes memory and operation limits but not a parallelism parameter. XChaCha20-Poly1305 requires a caller-supplied unique 24-byte nonce; SCARF does not generate or reuse nonces and does not implement SC1 chunk management. Authentication failures return SCARF_ERROR_AUTHENTICATION_FAILED and clear the destination plaintext. Assembly directories contain integration boundaries only.
make
make test
make bench
make fuzz
make cleanThe dependency-free host build keeps the external provider unavailable. flake.nix provides Clang, GNU Make, pkg-config, and libsodium for the enabled provider build.
scarf_kdf_argon2id returns derived material as an opaque scarf_key. The XChaCha20-Poly1305 API uses caller-supplied 24-byte nonces; nonce uniqueness and lifecycle remain the caller's responsibility. make fuzz builds an optional standalone AddressSanitizer harness, and make fuzz-run executes it against a file. Fuzzing is not part of normal builds.