Standard Library Module

std.sec — Cryptography, Capability Vaults & NIDS

A complete function-by-function guide to hardware-accelerated cryptography, constant-time token verification, capability-based secret vaults, and real-time network packet inspection in Nyx.

1. Why Does This Module Exist?

🛑 The Real-World Problem

In standard libraries (Node.js crypto, Python hashlib), developers frequently write timing-attack vulnerable code using standard string comparisons (token == user_token), leak unencrypted API keys in heap dumps, or struggle to inspect network packets for SQL injection and shellcode attacks in real-time without external C dependencies.

🛡️ The Nyx Solution

std.sec provides constant-time cryptographic equality (defeats timing attacks), AES-256 capability vaults that isolate secrets in memory, and an inline NIDS engine that inspects network payloads in < 2 microseconds with zero garbage collection overhead.

2. Function Reference & Tutorial

sec::sha256_hash(data: String) -> String

Computes the cryptographic SHA-256 hexadecimal hash string for input data.

Example:

import std.sec;

let hash = sec::sha256_hash("payload_to_verify");
print("SHA-256 Hash: {hash}");

sec::verify_token(token: String, secret: String) -> bool

Validates cryptographic auth tokens with constant-time equality check, completely preventing side-channel timing attacks.

Example:

import std.sec;

let is_valid = sec::verify_token(user_provided_token, expected_secret_token);
if is_valid {
    print("Authentication successful!");
}

vault::create_vault(name: String, master_key: String) -> SecurityVault

Initializes an in-memory AES-256 encrypted capability vault to store API keys and database credentials safely.

Example:

import std.sec.vault;

let mut vault = vault::create_vault("BankingVault", "MasterKey-2026-Strict");
vault.put_secret("DATABASE_PASSWORD", "SuperSecretPass123!");

// Retrieve only if correct capability token is provided:
let db_pass = vault.get_secret("DATABASE_PASSWORD", "CAP_ADMIN_AUTHORIZED");
print("Decrypted Secret: {db_pass}");

net::inspect_packet(scanner: &mut NidsScanner, ip: String, port: i32, payload: String) -> bool

Scans raw network packet payloads for SQL injection, cross-site scripting (XSS), buffer overflow shellcode, and anomaly signatures.

Returns: true if safe, false if malicious payload detected.

Example:

import std.sec.net;

let mut scanner = net::new_scanner();
let is_clean = net::inspect_packet(&mut scanner, "192.168.1.45", 8080, "SELECT * FROM users WHERE id = 1");
if !is_clean {
    print("ALERT: Threat detected! Dropping packet.");
}

3. Complete Tutorial: Zero-Trust Microservice Gateway

import std.sec;
import std.sec.vault;
import std.sec.net;

fn main() {
    print("Starting Zero-Trust Security Gateway...");

    // 1. Initialize encrypted vault for API tokens
    let mut vault = vault::create_vault("GatewayVault", "HardwareMasterKey#2026");
    vault.put_secret("STRIPE_KEY", "sk_live_98a72b1c8f4e2d");

    // 2. Setup real-time packet scanner
    let mut scanner = net::new_scanner();

    // 3. Inspect incoming request
    let incoming_payload = "GET /api/v1/checkout HTTP/1.1\nAuth: Bearer tok_sec99";
    let is_safe = net::inspect_packet(&mut scanner, "10.0.4.12", 443, incoming_payload);

    if is_safe {
        let stripe_key = vault.get_secret("STRIPE_KEY", "CAP_PAYMENTS_SERVICE");
        print("Gateway approved! Processing payment with token: {stripe_key}");
    }
}

← Return to Standard Library Index | Next: std.cloud (Distributed Mesh) →