Real attacks, not theory
The vectors reproduce vulnerabilities that have been exploited in the wild: padding oracles, invalid curve points, nonce misuse, signature malleability and more.
SECURITY ARCHITECTURE
Wycheproof Proofs
We do not ask you to trust our cryptography on faith. Every primitive OnionZero relies on is exercised against Project Wycheproof — Google's public suite of cryptographic attack vectors.
What is Project Wycheproof?
Wycheproof is Google's open-source collection of test vectors designed to break cryptographic implementations. It encodes decades of published attacks — the mistakes that have actually compromised real systems — into machine-checkable test cases.
The industry benchmark
Wycheproof is the same suite used to validate the cryptography inside major browsers, TLS libraries and mobile platforms. Passing it is the baseline for serious crypto engineering.
Repeatable and public
The test corpus is open and versioned. Results are reproducible by anyone — verification does not depend on our word.
The primitives we prove
OnionZero builds on a small, auditable set of standard primitives — each one exercised against the attack vectors that target it.
AES-256-GCM — file encryption
Authenticated encryption for every protected file. Wycheproof vectors probe nonce reuse, tag truncation, edge-case key and IV sizes, and authentication bypass attempts.
Ed25519 — license signatures
The signature scheme behind offline license envelopes. Tested against malleability, edge-case public keys, and verification of malformed signatures that must never pass.
X25519 — key exchange
Elliptic-curve key agreement used where secrets must be established between parties. Vectors cover invalid and small-order points, twist attacks and contributory-behavior edge cases.
Why this matters to you
A licensing and protection product is only as strong as its weakest primitive. Attack suites like Wycheproof exist precisely because "we used a standard algorithm" is not enough — implementation details decide outcomes.
- Your protection does not depend on a custom, unreviewed cipher
- Every primitive is a widely studied standard with public test coverage
- Known attack classes are tested against, release after release
- Your security review can cite an independent, public benchmark
BEYOND PHP
The same guarantee beyond PHP
OnionZero PE/Binary and Android protection seal ready-made .exe/.dll binaries and Android APKs under the same security architecture:
- PE/Binary and Android protection ride on the same audited primitive set — AES-256-GCM for payload sealing, Ed25519 for license signatures — exercised against the same Wycheproof vectors.
- The vendor public key is embedded in the runtime at build time (ionCube-style): the public key your customers verify against is exactly the one the test suite covered.
Cryptography you can audit
Need the details for your security assessment? Talk to us — we will walk your reviewers through the model.