SFT v2 - Secure Fragment Transfer (Hardened)

SFT v2 is a mission-critical cryptographic protocol and SDK for the secure distribution, approval, and reconstruction of sensitive fragments (shards) across heterogeneous environments (Android, Browser, Node.js).

It is designed for Zero Trust architectures, where the execution environment is assumed to be hostile, and security must be enforced by hardware-backed keys and cryptographic bindings.

🛡️ Hardened Security Architecture

• Context Binding (Fingerprinting): Every signature and token is cryptographically bound to a unique public key fingerprint (fp) and device context (dev), preventing context-swap and token-theft attacks.
• Hardware Key Isolation:
  • Web/Browser: Strictly enforces extractable: false for RSA private keys, trapping them in the Web Crypto sandbox.
  • Android: Native bridge to Android KeyStore, leveraging hardware-backed TEE/SE for all private key operations.
• AES-GCM AAD (Authenticated Metadata): All protocol metadata (version, profile, nonce, exp) is authenticated as Additional Authenticated Data. Tampering with a single byte of metadata renders the ciphertext undecryptable.
• Anti-Replay Mechanism: Mandated nonce, iat, and exp fields across all payloads, with integrated support for backend nonce-tracking.

🚀 Quick Start

Installation

npm install sft-protocol

Encryption & Vault (Stateless)

import SFT from 'sft-protocol';

// Create a hardened vault (Token)
const vaultToken = await SFT.Vault.createToken(
  "SECRET_DATA",
  publicKeyPem,
  3600, // 1h TTL
  { issuer: 'MyCompany' }
);

Multi-Signature Approval

// Step 1: Create an approval request
const request = await SFT.Auth.createRequest({
  keyId: 'vault-01',
  operation: 'ACCESS_GRANTED',
  threshold: 2,
  totalShares: 3,
  publicKeyPem: adminPubKey
});

// Step 2: Guardian sign (Contextualized)
// NOTE: In Android/Browser, 'privateKey' is a Handle/Alias, NOT raw material.
const confirmation = await SFT.Auth.signConfirmation(request, {
  approverId: 'guardian-alpha',
  deviceId: 'secure-mobile-01',
  privateKey: guardianKeyHandle, // KeyStore Alias or CryptoKey object
  publicKeyPem: guardianPubKey
});

📱 Cross-Runtime Support

• Browser: Built on standard Web Crypto API. Uses non-extractable keys (Safe from XSS data extraction).
• Android: Bridge-aware. Seamlessly integrates with WebView/Mobile infrastructures. The private key material remains locked in the Hardware Enclave (TEE/SE) and is accessed via Alias.
• Node.js / Desktop: Powered by node-forge (Canonicalization engine) for full protocol consistency.

📖 Documentation

For a full technical deep-dive, API reference, and threat model analysis, see the SFT v2 Documentation Guide.

📊 Comparison: SFT vs Standard JWT/AES

| Feature | Standard JWT/AES | SFT v2 (Hardened) | | :--- | :---: | :---: | | Metadata Integrity | Logic-based | Cryptographic (AAD) | | Key Isolation | Software-level | Hardware (Enclave) | | Anti-Replay | Optional | Protocol Mandated | | Identity Binding | Subject string | Public Key Fingerprint | | Context-Swap Protection | None | Device & Key Bound |

⚖️ License

Licensed under Apache 2.0. Copyright (c) 2026 RIvale Security.