$ show cossacklabs/themis
Themis is a cross-platform cryptographic library developed by Cossack Labs, providing high-level security primitives such as Secure Cell (symmetric encryption with three modes: Seal, Token Protect, Context Imprint), Secure Message (asymmetric encryption and digital signing), Secure Session (mutual authentication and key exchange), Secure Comparator (zero-knowledge password comparison), and key generation (EC, RSA, symmetric). The core is implemented in C with a cryptographic engine abstraction layer (Soter) that supports OpenSSL, BoringSSL, and a custom Ed25519 implementation. The library exposes consistent APIs across 13+ language wrappers including Python, Go, Rust, Java, Swift, Objective-C, JavaScript (Node.js and WebAssembly), PHP, Ruby, C++, and React Native. The codebase is well-structured with extensive unit, integration, and fuzz testing, CI/CD pipelines for each wrapper, and cross-language compatibility tests. While the repository has deprecated older APIs and maintains multiple backends, it remains actively maintained with regular releases, security patches, and community engagement.
The LLM identified 3 files worth highlighting for reuse:
Implements the Soter asymmetric cipher operations (encrypt/decrypt) using OpenSSL as the backend. This file is part of a larger abstraction that allows Themis to switch between OpenSSL, BoringSSL, and custom implementations without changing higher-level code. The pattern of defining a uniform internal API (soter_asym_cipher.h) with multiple platform-specific implementations is reusable in any project requiring cryptographic backend portability.
Provides a safe Rust wrapper around the C Secure Cell API, using the `libthemis-sys` crate for FFI bindings. The wrapper follows a builder pattern: `SecureCell::with_key(&symmetric_key).seal().encrypt(message, context)`. It handles buffer size negotiation, error conversion from C status codes, and memory wiping via `Drop`. This pattern is reusable for creating safe, idiomatic Rust bindings for any C library with a similar buffer-size-query protocol.
Offers a modern C++ RAII wrapper to the C Secure Cell API. It defines template classes for each mode (SecureCellSeal, SecureCell TokenProtect) with explicit key or passphrase constructors. The class handles automatic buffer alloccation and memory cleaning through destructors. The pattern of using a backend C library with C++ scope-garded resource management and type-safe enums for modes is a clean, reuseable design for any cryptographic library wrapper.