RUPGuard - C++20 authenticated-decryption release gate and mu

项目说明

RUPGuard

![CI]()

RUPGuard is a C++20 authenticated-decryption release gate and mutation-matrix
test harness. Its public API cannot produce a plaintext value until AES-256-GCM
authentication succeeds. The audit command then flips one bit at every byte
position, tests every truncation boundary, and checks wrong-key, wrong-context,
and trailing-data cases. It emits a machine-readable report showing whether any
invalid input crossed the plaintext release boundary.

This is a new defensi combination, not a new cipher. RUPGuard makes no
claim that AES-GCM, release-of-un research, or mutation testing
is novel by itself.

What is different

A mo type is the only public plaintext output.

The constructor is private; only a successful authenticated open can create it.

All header fields and a caller-supplied context are authenticated as AAD.

A full byte mutation and truncation matrix produces JSON e.

Invalid inputs ne an output file in the CLI.

AES-256-GCM is compiled from pinned Mbed TLS source; WinCrypt is not used for

encryption. The operating system is still used as an entropy source.

Build

Requirements: CMake 3.24+, Git, and a C++20 compiler. The first configure fetches
the pinned Mbed TLS 3.6.7 source and builds its static crypto library.

Use

RUPGuard refuses to o files. Keep the raw 32-byte key separate from the
en and protect it with filesystem permissions or a platform keystore.

Security status

This is an educational security tool and research prototype, not audited
production cryptography. It intentionally uses a implementation of the
standardized AES-GCM construction instead of in a cryptographic primitive.
See THREAT_MODEL.md for the exact boundary and
FORMAT.md for the authenticated en.

Prior art and references

NIST SP 800-38D defines GCM

and its authenticated-data behavior.

Andreeva et al., *How to Securely Release Un Plaintext in

Authenticated Encryption* (2014),
formalizes the RUP problem.

Project Wycheproof provides

cryptographic test , including invalid AEAD inputs. RUPGuard focuses
instead on an application's plaintext-release boundary and generates
per-en mutation e.

Mbed TLS 3.6.7

supplies the pinned AES-GCM and entropy implementations.

License

MIT. Mbed TLS is fetched as a separate third-party dependency under its own
Apache-2.0 OR GPL-2.0-or-later license.

项目信息

开发语言：C++

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕C++20 authenticated-decryption release gate and mutation-matrix harness for detecting unverified plaintext release展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。