Metadata-Version: 2.4
Name: ztop
Version: 1.1.0
Summary: Zero Trust Transfer Orchestration Protocol -- RFC reference implementation (v1.1.0, 8 Advanced Upgrades)
Author-email: ZTOP Research Group <ztop@zero-trust-consortium.org>
License: MIT License
        
        Copyright (c) 2026 ZTOP Research Group, Zero Trust Consortium
        
        Permission is hereby granted, free of charge, to any person obtaining a copy
        of this software and associated documentation files (the "Software"), to deal
        in the Software without restriction, including without limitation the rights
        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
        copies of the Software, and to permit persons to whom the Software is
        furnished to do so, subject to the following conditions:
        
        The above copyright notice and this permission notice shall be included in all
        copies or substantial portions of the Software.
        
        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
        SOFTWARE.
        
Project-URL: Homepage, https://github.com/sripad2020/ztop-research
Project-URL: Documentation, https://github.com/sripad2020/ztop-research#readme
Project-URL: Repository, https://github.com/sripad2020/ztop-research
Project-URL: Bug Tracker, https://github.com/sripad2020/ztop-research/issues
Project-URL: Changelog, https://github.com/sripad2020/ztop-research/blob/main/CHANGELOG.md
Keywords: zero-trust,file-transfer,protocol,cryptography,security
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Internet
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: System :: Networking
Classifier: Typing :: Typed
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=41.0
Requires-Dist: click>=8.1
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == "dev"
Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
Requires-Dist: ruff>=0.4; extra == "dev"
Requires-Dist: mypy>=1.10; extra == "dev"
Requires-Dist: build>=1.2; extra == "dev"
Requires-Dist: twine>=5.0; extra == "dev"
Provides-Extra: pqc
Requires-Dist: oqs-python>=0.9.0; extra == "pqc"
Provides-Extra: quic
Requires-Dist: aioquic>=0.9.25; extra == "quic"
Provides-Extra: dashboard
Requires-Dist: fastapi>=0.111; extra == "dashboard"
Requires-Dist: uvicorn[standard]>=0.30; extra == "dashboard"
Provides-Extra: grpc
Requires-Dist: grpcio>=1.64; extra == "grpc"
Requires-Dist: grpcio-tools>=1.64; extra == "grpc"
Requires-Dist: protobuf>=5.0; extra == "grpc"
Provides-Extra: storage
Requires-Dist: aiosqlite>=0.20; extra == "storage"
Provides-Extra: analysis
Requires-Dist: yara-python>=4.5; extra == "analysis"
Requires-Dist: scikit-learn>=1.5; extra == "analysis"
Requires-Dist: numpy>=1.26; extra == "analysis"
Provides-Extra: full
Requires-Dist: ztop[analysis,dashboard,grpc,pqc,quic,storage]; extra == "full"
Dynamic: license-file

# ZTOP — Zero Trust Transfer Orchestration Protocol

[![PyPI version](https://img.shields.io/pypi/v/ztop.svg)](https://pypi.org/project/ztop/)
[![Python](https://img.shields.io/pypi/pyversions/ztop.svg)](https://pypi.org/project/ztop/)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)

ZTOP is a Python reference implementation of the **Zero Trust Transfer Orchestration Protocol**, an Application Layer (OSI Layer 7) protocol for cryptographically authenticated, continuously attested peer-to-peer file transfer in Zero Trust Architectures (ZTA).

---

## Overview

Traditional file transfer protocols (SFTP, FTP) authenticate once and establish a trusted channel. ZTOP integrates every Zero Trust principle natively into the protocol itself:

| Feature | Description |
|---|---|
| Cryptographic Peer Identity | HKDF-SHA512 + Ed25519 derived from hardware device UUID |
| Continuous Attestation | 16-field Heartbeat with 8 validation checks every 10 seconds |
| 5-Layer Certificate Chain | Root CA, Org CA, Device, Session, Transfer Receipt — X.509 P384 |
| Trust Scoring | 100-point composite posture score with 7-factor evaluation |
| Policy Engine | 6 independent checks before any transfer is authorized |
| Merkle Tree Integrity | Per-chunk SHA-256 verification with proof ascent |
| Cryptographic Execution Manifest | 380-byte signed CEM prepended to every transferred file |
| Pre-Execution Static Analysis | Entropy, PE/ELF/Python behavioral analysis before delivery |
| 7-Level Signature Chain | All 7 Ed25519 signatures required for SYNC_COMPLETE |
| Trust-Preserving Reconnection | Resumes from last verified chunk after disconnect |
| Real ECDSA-P384 Audit Records | Gateway seals every transfer with real P384 signatures |

---

## Installation

```bash
pip install ztop
```

Requires Python 3.11 or later.

### Development installation

```bash
git clone https://github.com/sripad2020/ztop-research
cd ztop-research
pip install -e ".[dev]"
```

---

## Quick Start

### Start a gateway server

```bash
ztop server
# or with custom address
ztop server --host 0.0.0.0 --port 7890 --log-level DEBUG
```

### Connect and upload a file

```bash
ztop client --file /path/to/document.pdf
# or specify target
ztop client --host 10.0.0.5 --port 7890 --file /path/to/file --device-id my-laptop --org-id acme-corp
```

### Run the self-contained demo (no setup required)

```bash
ztop demo
```

### Run the advanced X.509 certificate demo

```bash
ztop cert-demo
```

### Check version

```bash
ztop version
```

---

## Session Lifecycle

```
Client                           Gateway
  |                                 |
  |-------- HELLO ----------------> |   Phase 1: Discovery
  |<------- DISCOVER --------------- |
  |-------- REGISTER -------------> |   Phase 2: Identity
  |<------- IDENTITY_REQUEST ------- |   Ed25519 challenge issued
  |-------- IDENTITY_RESPONSE ----> |   64-byte sig + 32-byte pubkey
  |-------- TRUST_REQUEST --------> |   Phase 3: Device Posture
  |<------- TRUST_RESPONSE --------- |   Score assigned
  |-------- POLICY_REQUEST -------> |   Phase 4: Policy Evaluation
  |<------- POLICY_RESPONSE -------- |   6-check authorization
  |-------- CAPABILITY_NEGOTIATE -> |   Phase 5: Negotiation
  |<------- CAPABILITY_NEGOTIATE --- |   chunk_size, window
  |-------- SESSION_CREATE -------> |   Phase 6: Session Active
  |<------- SESSION_ACCEPT --------- |
  |-------- TRANSFER_REQUEST -----> |   Phase 7: File Transfer
  |<------- TRANSFER_START --------- |
  |-------- TRANSFER_CHUNK x N ---> |   PAYLOAD_ENCRYPTED required
  |<------- TRANSFER_ACK ----------- |   per-chunk Merkle verification
  |-------- TRANSFER_COMPLETE ----> |   Phase 8: Audit
  |<------- INTEGRITY_VERIFY ------- |   SHA-3-512 file check
  |<------- AUDIT_COMMIT ----------- |   ECDSA-P384 sealed record
  |-------- SESSION_CLOSE --------> |   Phase 9: Graceful Close
  |<------- SESSION_CLOSE ---------- |
```

---

## Architecture

```
ztop/
  protocol/       Binary wire format (packet.py, states.py, messages.py)
  core/           Session state management (session.py)
  engines/
    trust_engine.py       Device posture scoring (100-point scale)
    policy_engine.py      6-check transfer authorization
    heartbeat_engine.py   Continuous 8-check attestation
    merkle_engine.py      Binary SHA-256 Merkle tree
    cem_engine.py         Cryptographic Execution Manifest
    audit_engine.py       ECDSA-P384 audit record sealing
    cert_engine.py        X.509 5-layer certificate hierarchy
    signature_chain.py    7-level Ed25519 signature chain
    peer_id_engine.py     HKDF hardware-derived Peer ID
    integrity_engine.py   Per-chunk and file-level hash verification
    tamper_engine.py      Adaptive Tamper Resistance Score (TRS)
    execution_analyzer.py Pre-execution static behavioral analysis
    reconnect_engine.py   Trust-preserving session resumption
    metadata_engine.py    19-field dual-signed metadata exchange
  network/
    server.py             asyncio TCP gateway server
    client.py             asyncio client agent
  cli.py                  click-based command-line interface
```

---

## Security Notes

- **Transport**: ZTOP is designed to run inside a TLS 1.3 tunnel. The reference implementation uses plain TCP for development convenience. For production use, place behind a TLS terminator or enable TLS in the network layer.
- **HMAC Keys**: The current implementation does not perform a key exchange during the handshake. Both sides use an unshared key by default, so HMAC validation is not enforced. A full ECDH-based key exchange is planned for v1.1.
- **Post-Quantum**: Ed25519 and ECDSA-P384 are not quantum-resistant. Future versions will incorporate NIST-standardized post-quantum algorithms.

See [SECURITY.md](SECURITY.md) for the full threat model and responsible disclosure policy.

---

## Running Tests

```bash
pip install -e ".[dev]"
pytest tests/ -v --tb=short
```

---

## Building for PyPI

```bash
python -m build
twine check dist/*
twine upload dist/*
```

---

## IETF Reference

This implementation targets **draft-ztop-secdispatch-protocol-00**, submitted to the IETF SECDISPATCH working group.

Internet-Draft: [https://datatracker.ietf.org/drafts/current/](https://datatracker.ietf.org/drafts/current/)

---

## License

MIT — see [LICENSE](LICENSE).
