// the find
PentHertz/LUKSbox
Store sensitive files in the cloud, or on shared media without trusting the host. LUKSbox is a Rust-based encrypted-container tool with passphrase, FIDO2 (YubiKey, Titan, Nitrokey, Windows Hello), TPM 2.0/SEP, and hybrid post-quantum (ML-KEM-768 / 1024) keyslots. Mounts as a real drive on Linux, macOS, and Windows.
LUKSbox is a Rust tool for creating encrypted container files (.lbx) you can store on untrusted cloud or shared media — the provider gets an opaque blob, you hold the keys. It supports passphrase, FIDO2 hardware tokens, TPM 2.0, and a post-quantum hybrid keyslot using ML-KEM-768/1024. Pre-1.0, built by a French security research firm, aimed at developers and security-conscious users who actually understand the threat model.
The cryptographic design is carefully layered: keyslots wrap a Master Volume Key via HKDF-SHA256, per-chunk AAD includes file_id+chunk_index+generation to block chunk replay and positional swap attacks, and the detached header option leaves the vault file genuinely indistinguishable from random data. The post-quantum approach is a proper hybrid (classical + ML-KEM via HKDF mixing), not a bolt-on, and uses the FIPS 203-standardised algorithm. The security engineering is unusually thorough for a young project: 9 internal audit rounds documented, 10 libFuzzer harnesses with 30M+ iterations, constant-time bench harnesses using dudect, memfd_secret(2) for the unlocked MVK on Linux 5.14+, and O_NOFOLLOW on extraction to block symlink-staging attacks. The workspace layout is clean — luksbox-core, luksbox-format, luksbox-vfs, and luksbox-mount are genuinely separate crates with distinct responsibilities, not a monorepo pretending to have layers.
No external audit yet — nine rounds of self-review by the same team that wrote the code is not a substitute, and the on-disk format being 'locked' before an independent audit is a real risk if something structural is wrong. The v2-to-v3 migration path requires explicit opt-in and leaves old binaries refusing v3 vaults, which means any team deployment immediately has a compatibility split to manage. Windows support depends on WinFsp (an unmaintained transitive dependency flagged by cargo audit) and the FUSE-T macOS path is a separate crate wrapping a C shim, both of which are likely to be the first things that break. The GUI is egui — functional but not what users on macOS or Windows expect from a security-sensitive vault application, and the clipboard guard for passphrases is hand-rolled rather than using platform keychain APIs.