Your Application              Citadel                         Database
       |                         |                               |
       |-- POST /encrypt ------->|                               |
       |                         |-- hybrid KEM (X25519+ML-KEM)  |
       |                         |-- derive AES-256 key (HKDF)   |
       |                         |-- encrypt with AES-256-GCM    |
       |<-- encrypted blob ------|                               |
       |                                                         |
       |-- store blob ------------------------------------------>|

citadel-envelope    Hybrid encryption core (X25519 + ML-KEM-768 + AES-256-GCM)
citadel-keystore    Key lifecycle management, 4-level hierarchy, threat-adaptive policies
citadel-api         HTTP server, scoped API key auth, rate limiting, real-time dashboard

# Clone
git clone https://github.com/mrcord77/rust_citadel.git
cd rust_citadel

# Set your admin API key
echo -n "your-secret-key" | sha256sum | cut -d' ' -f1
# Copy the hash

# Start
CITADEL_API_KEY_HASH=<paste-hash> docker compose up -d

# Verify
curl http://localhost:3000/health
# {"status":"ok","version":"0.2.0"}

cargo build --release -p citadel-api
CITADEL_API_KEY="your-secret-key" CITADEL_SEED_DEMO=true ./target/release/citadel-api

import requests

api = "http://localhost:3000"
headers = {"Authorization": "Bearer your-secret-key"}

# Encrypt
r = requests.post(f"{api}/api/keys/{dek_id}/encrypt", headers=headers, json={
    "plaintext": "sensitive data",
    "aad": "record-001",        # binds ciphertext to this record
    "context": "patient-records" # domain separation
})
blob = r.json()

# Decrypt
r = requests.post(f"{api}/api/decrypt", headers=headers, json={
    "blob": blob,
    "aad": "record-001",
    "context": "patient-records"
})
plaintext = r.json()["plaintext"]

# Status
curl http://localhost:3000/api/status -H "Authorization: Bearer $KEY"

# List keys
curl http://localhost:3000/api/keys -H "Authorization: Bearer $KEY"

# Encrypt
curl -X POST http://localhost:3000/api/keys/$DEK_ID/encrypt \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{"plaintext":"hello","aad":"test","context":"demo"}'

Root Key
  └── Domain Key (per environment / business unit)
        └── KEK — Key Encrypting Key (wraps DEKs)
              └── DEK — Data Encrypting Key (encrypts application data)

version[1] || suite_kem[1] || suite_aead[1] || flags[1] || kem_ct_len[2] ||
x25519_ephemeral_pk[32] || mlkem768_ct[1088] || nonce[12] || aead_ct[variable]

rust_citadel/
├── citadel-envelope/        # Core hybrid encryption library
│   ├── src/
│   │   ├── envelope.rs      # Encrypt/decrypt operations
│   │   ├── kem.rs           # X25519 + ML-KEM-768 hybrid KEM
│   │   ├── kdf.rs           # HKDF-SHA256 key derivation
│   │   ├── wire.rs          # Wire format encode/decode
│   │   ├── aead.rs          # AES-256-GCM wrapper
│   │   ├── aad.rs           # Additional authenticated data
│   │   ├── error.rs         # Uniform error types
│   │   └── sdk.rs           # High-level API
│   ├── tests/               # KAT + roundtrip tests
│   └── fuzz/                # Fuzz targets
├── citadel-keystore/        # Key lifecycle management
│   └── src/
│       ├── keystore.rs      # Key CRUD + state machine
│       ├── policy.rs        # Crypto-period policies
│       ├── threat.rs        # Adaptive threat intelligence
│       ├── storage.rs       # File-based key storage
│       ├── audit.rs         # Integrity-chained audit log
│       └── types.rs         # Key types and states
├── citadel-api/             # HTTP server
│   └── src/
│       ├── main.rs          # API routes, auth, rate limiting
│       └── dashboard.html   # Real-time security dashboard
├── citadel_example.py       # Python integration example
├── Backup-Citadel.ps1       # Backup/restore tooling
├── docker-compose.yml       # Development deployment
├── docker-compose-production.yml  # Production with TLS
├── SPEC.md                  # Wire format specification
├── THREAT_MODEL.md          # Security goals and attacker model
├── COMPLIANCE_MATRIX.md     # NIST 800-57 control mapping
└── CITADEL_OVERVIEW.md      # Commercial overview