Security analyst by day · cryptographic researcher by night.
I build high-assurance security tools and design symmetric primitives.
I work mostly in C and C++, by choice — original cryptographic design & cryptanalysis, post-quantum applications on NIST standards (Kyber/ML-KEM, ML-DSA, SLH-DSA), digital forensics, and clean GTK3/4 front-ends. Original research, post-quantum by default, no dependencies, close to the metal.
Heat v1.0.1
Sentinel v1.0.5
Husk v1.0.0
Pulse v1.0.0
Post-Quantum · Encryption & Privacy · Forensics & Secure Erase · Monitoring & Auditing · Featured · Systems Security · Cryptography · Learning · Contact
Tip
⭐ A star goes a long way — it helps others find the work and keeps me building. Thank you.
NIST-standard post-quantum applications — hybrid KEM & signatures by default.
| Project | What it does |
|---|---|
| GTK3 encrypted disk manager — AES-256-GCM volumes behind a Kyber-1024/X448 hybrid KEM, with FUSE mounting and IND-RND plausible deniability. ⭐ | |
| Command-line Axis — the same AES-256-GCM volumes and Kyber-1024/X448 hybrid KEM with FUSE mounting, GUI-free for servers and automation; reads the same containers as Axis. | |
| Working GTK3 calculator that secretly launches Axis on a passcode — hiding that an encrypted disk manager is even installed. ⭐ | |
| Tamper-evident audit log — append-only, hash-chained and forward-secure, sealed with post-quantum ML-DSA/SLH-DSA and Merkle proofs. | |
| Serverless encrypted messenger (GTK3) — a Kyber-1024/X448 hybrid KEM handshake seeds a Signal Double Ratchet, giving every message forward secrecy and post-compromise security, with an optional CPace passphrase to defeat MITM. | |
| GTK3 encrypted notes app — free-form notes sealed as one AEAD blob (AES-256-GCM / XChaCha20-Poly1305) behind a Kyber-1024/X448 hybrid KEM and Argon2id, unlocked by one master password. | |
| Incremental encrypted backups — deduplicating, content-addressed snapshots under a Kyber-1024/X448 hybrid KEM, manifests signed with ML-DSA-44,65 or 87. ⭐ | |
| Post-quantum secret sharing (GTK3 + CLI) — split a passphrase, key or file into N shares so any K reconstruct it and fewer reveal nothing (Shamir's Secret Sharing over GF(2⁸)), with optional per-share sealing behind a Kyber-1024/X448 hybrid KEM and Argon2id. | |
| Post-quantum file signing — detached ML-DSA (FIPS 204) & SLH-DSA (FIPS 205) signatures; secret keys sealed with Argon2id + AES-256-GCM. | |
| Peer-to-peer file transfer — serverless, end-to-end encrypted over a Kyber-1024/X448 hybrid KEM, with an optional passphrase to defeat MITM. | |
Post-quantum compressing archiver (GTK3 + CLI) — packs files and folders into one password-protected .pqz: zlib DEFLATE then AEAD (AES-256-GCM / XChaCha20-Poly1305) behind a Kyber-1024/X448 hybrid KEM and Argon2id. |
|
| 2FA authenticator (GTK3 + CLI) — TOTP/HOTP seeds in a post-quantum hybrid-KEM vault behind one master password. | |
| GTK3 password manager — vault sealed with AEAD and a Kyber-1024/X448 hybrid KEM behind one master password. | |
Post-quantum file-integrity monitor (CLI/C++) — hashes a directory tree with SHA3-512, seals the baseline with an ML-DSA (FIPS 204) signature, and reports exactly what changed; incremental inotify live watching, with the secret key sealed by Argon2id + AES-256-GCM. ⭐ |
AEAD file encryption, encrypted-cloud clients and privacy hygiene.
| Project | What it does |
|---|---|
| GTK3 file encryptor — AEAD ciphers (AES-256-GCM, XChaCha20-Poly1305) with an optional Kyber-1024/X448 hybrid KEM and Argon2id. | |
| Dependency-free encryption CLI — four AEAD ciphers (AES-256-GCM, XChaCha20, Serpent, Twofish) over an Argon2id KDF. ⭐ | |
| Compress-and-encrypt archiver — multithreaded zstd streamed through XChaCha20-Poly1305, with Argon2id keys and file splitting. | |
| GTK3 front-end for gocryptfs — initialize, mount and unmount encrypted volumes without touching the command line. | |
| Dependency-free metadata scrubber — natively strips Exif/XMP/IPTC (and C2PA) from JPEGs and PNGs before you share them. | |
RAM-only image viewer (X11) — mlocks pixels in physical memory and zeroes them on teardown; JPEG/PNG, no swap leaks. |
|
| Desktop client for Filen.io (C++/GTK4) — browse, upload, download and manage your end-to-end encrypted cloud files, with all encryption and decryption performed locally. | |
| Desktop client for Proton Drive (C++/GTK4) — sign in with Proton's SRP, then browse, upload, download and trash your end-to-end encrypted files, with all key handling and decryption performed locally. |
Disk imaging, file recovery and forensic-grade sanitization.
| Project | What it does |
|---|---|
| GTK3 forensics tool — multithreaded block-level disk imaging with file carving (JPEG/PNG/PDF/ZIP) and credential/key search. | |
Read-only ext2/3/4 recovery suite (C++/CLI) — undeletes inodes via debugfs and carves files straight from raw free blocks (string + signature, block-aligned), with recoverability scoring, SHA-256 hashing and a CSV manifest. |
|
| Read-only ELF inspector (C++/CLI + GTK4) — reports a binary's security posture without ever running it: on-disk setuid/setgid & permission bits, decoded POSIX file capabilities, and exploit mitigations (PIE, NX, RELRO, stack canary, FORTIFY, RPATH), plus dynamic dependencies and risky imports. | |
Live-memory scanner (CLI) — searches a running process's /proc/<pid>/mem for byte patterns or file-magic headers. |
|
| SSD-aware secure-delete tool (interactive + CLI) — combines a fast non-compressible ChaCha20 overwrite with per-file punch-hole and filesystem TRIM to wipe files, directories and free space. Also wipes free RAM to clear leftover secrets from memory. ⭐ | |
| CLI data sanitizer — irrecoverably wipes files, directories, free space and RAM to NIST SP 800-88 / FIPS 140-3, with SSD TRIM. | |
Forensic file triage (CLI + GTK4) — profiles a file's Shannon entropy as a heatmap, identifies its true type by magic bytes, and flags extension/content masquerades and data appended past a format's logical end, scoring every file from clean to SUSPICIOUS. |
|
| Multi-core secure-erase suite (GTK3) — saturates NVMe/SSD throughput wiping disks, free space and RAM to NIST/FIPS standards. |
Security scanners, live system monitors, integrity checks and firewalls.
| Project | What it does |
|---|---|
| GTK3 front-end for chkrootkit — live, color-coded rootkit scans with one-click false-positive filtering. | |
Real-time TCP monitor (GTK3) — reads /proc/net/tcp and maps every live connection to its owning process. |
|
Real-time disk I/O monitor (C++/GTK4) — live read/write throughput from /proc/diskstats with a Tokyo Night Cairo graph and session peaks/averages. |
|
CLI password generator — getrandom() CSPRNG with an entropy analyzer that penalizes repeats, sequences and dictionary words. |
|
| GTK3 edition of Entropy — naive vs. realistic password entropy with a color-coded strength meter and one-click copy. | |
| GTK3 system-security scanner — audits your Linux box's posture (firewall, exposed ports, SSH, sudo, accounts, kernel hardening) and produces a severity-ranked report with copy-paste fixes, exportable to PDF. | |
| GTK4 front-end for fail2ban — browse jails with live ban counts, ban/unban IPs (per-jail or across all jails), tune bantime/findtime/maxretry, and start/stop/reload jails or the server from one window; a privileged helper is authorized once via pkexec, and it minimizes to the system tray. | |
| GTK3 front-end for Lynis — live, color-coded security audits with a one-click pentest mode. | |
| Secret scanner — recursively greps a tree for leaked credentials via regex + Shannon entropy, with a CLI and a GTK3 triage UI. | |
Bandwidth limiter (GTK3 + CLI) — caps combined up/down speed on any interface via Linux tc, optionally as a boot-time service. |
|
| All-in-one system monitor (C++/GTK4) — live CPU load & per-core usage, temperature (°C/°F), load averages, RAM/swap, per-filesystem disk usage with I/O throughput, and network speed & connections, in one tabbed Tokyo Night dashboard that minimizes to the system tray. | |
CPU temperature monitor (C++/GTK4) — watches CPUpackage temperature over time with a live heat‑gradient graph, real‑time stats (current/min/avg/max), °C/°F toggle, and PDF export (per‑minute detail via pdflatex); reuses Pulse's temperature‑reading logic (coretemp/k10temp/hwmon/thermal zones) and minimizes to the system tray. |
|
| GTK3 + Cairo RAM analyzer — top memory hogs, live ring gauges and bar charts, and verified-kill process termination. | |
| GTK3 front-end for rkhunter — live, color-coded rootkit scans with a problems-only filter. | |
| Unified machine guardian (C++/GTK4) — one Tokyo Night window reuniting live system vitals (CPU/temp/RAM/disk/network), a per-process outbound firewall (NFQUEUE), and continuous security-posture scanning that re-scans and diffs in real time to surface new exposures the moment they appear; a single root daemon serves the firewall and posture, and it minimizes to the system tray. | |
| GTK4 systemd service manager (C++) — lists every service on the machine and lets you start/stop, enable/disable and mask/unmask them from one window, with live search; privileged actions are elevated per-operation via pkexec. | |
GTK3 disk-space analyzer — threaded scan from / with live percentage bars, an interactive donut and folder drill-down. |
|
| File-integrity monitor (CLI + GTK3) — recursively hashes a tree with SHA3-512, baselines it, and flags any changed file on re-scan. ⭐ | |
| Real-time network monitor (GTK3) — live up/down speeds and a Tokyo Night Cairo graph, with a settable usage limit that counts down and turns red when exceeded. | |
GTK4 outbound firewall — diverts every new connection to NFQUEUE, resolves the owning process via /proc, and prompts to allow/deny once or forever; rules are keyed on a SHA-256 of the binary so a swapped executable re-prompts. |
Ultra-secure encrypted disk manager — hybrid post-quantum key encapsulation with plausible deniability.
Kyber-1024 + X448 hybrid KEM · AES-256-GCM · Argon2id (1 GB) · FUSE 3 mounting · IND-RND plausible deniability · locked non-dumpable memory.
The Axis dashboard — create or open an encrypted volume, then mount it as a transparent FUSE filesystem with a single password
Hardware-assisted memory safety & defensive systems.
| Project | What it does |
|---|---|
| GTK3 decoy-encryption vault — DTE turns every wrong passcode into a plausible fake plaintext, neutralizing offline brute force. (2026) | |
| Hardware-assisted memory allocator — Intel MPK/PKU for temporal safety and metadata integrity at just 3.8% overhead over ptmalloc. ⭐ (2026) | |
| Paranoid-grade Linux hardening guide — disk encryption, SSH, firewall, MAC, auditing and anti-forensics, with defense-in-depth and real commands. | |
| Paranoid-grade Windows 10/11 & Server hardening guide — BitLocker, Defender ASR, AppLocker/WDAC and firewall lockdown in PowerShell, on CIS baselines. | |
| Topological intrusion detector — flags DDoS, port scans and exfiltration by their persistent-homology shape, not signatures; 0.03% FPR on CIC-IDS2017. ⭐ (2026) |
Symmetric permutations, cryptanalysis & permutation-driven tools.
| Project | What it does |
|---|---|
| 2048-bit SPN-ARX permutation — the wide-trail Krakken-2048 Abyssal core for sponge AEAD and hashing. (2026) | |
| Krakken-2048 + XRBD — an XOR-rotation butterfly-diffusion layer reaching full word-level avalanche in 8 rounds. ⭐ (2026) | |
| MILP-proven bounds for XRBD — ≥229 active S-boxes over 8 rounds, bounding every differential/linear characteristic below 2⁻¹³⁷⁴. (2026) | |
| Engineering-correctness harness — KAT-pinned regression, invertibility, avalanche and tamper checks for Krakken-2048 and Krakken-Disk V5. | |
| Cryptanalysis & verification suite — SAC/diffusion, NIST SP 800-22, division-property MILP and collision tests. (2026) | |
| GTK3 encrypted disk manager driven by the Krakken-2048 Abyssal permutation — 256-bit post-Grover margin with a Kyber-1024/X448 hybrid KEM. | |
| Krakken-Disk on the Butterfly permutation — a faster 8-round XRBD core with stronger security margins. ⭐ | |
| Command-line Krakken-Disk Butterfly — the same post-quantum core, GUI-free for servers and automation. |
| Project | What it does |
|---|---|
| Complete beginner's guide to C — assumes zero prior code and builds up from compilation and variables through control flow, functions, arrays, pointers, structs, and stack/heap memory, closing with 5 graded exercises and where to go next. | |
| Complete beginner's guide to Python — from your first line through data types, control flow, functions, lists/dicts/sets, strings, exceptions, and files & modules, with PEP 8 style and 5 graded exercises; a natural follow-on to the C guide. |
I'm offering to develop security software at no cost. If there's a specific security-related tool you need, email me your idea and I'll get to work on it.
Tech & tooling
