FALlen

Designed for large files, audited from every angle

FALlen is not a toy cipher. Every component — from the custom ARX permutation to the container format — has been independently probed, fuzzed, and adversarially audited.

One master seed, infinite derived keys

A per-file 256-bit random file_id and a fresh random salt separate every encryption. All chunk keys, nonces, and MAC keys are derived from the master seed with domain separation.

Domain Separation Table

Each derivation purpose absorbs a unique domain byte first, making outputs independent even with identical seeds.

The FALlen Permutation

A 1024-bit state (16 × 64-bit words) processed through 32 rounds. Each round applies addition, XOR, rotation, word permutation, two triangular nonlinear layers, and a π-derived round constant.

The .fal binary layout

Version 1, all integers little-endian. A fixed 40-byte header, followed by salt, file ID, encrypted metadata, chunk records, and a trailer.

"FALCHUNK1" || version || flags[2] || file_id || chunk_number(u64) || plaintext_len(u32)

Encrypt and decrypt in seconds

Requires CMake ≥ 3.14, a C++20 compiler, and OpenSSL ≥ 3.0.

cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build
ctest --test-dir build

# Interactive password prompt (read twice, no echo)
falencrypt -f plain.txt -o plain.txt.fal

# Explicit KDF parameters
falencrypt -f large_dataset.csv -o large_dataset.csv.fal \
    --memory-kb 131072 --time-t 3 --parallelism 1

# With compression (110 KB text → 21 KB container)
falencrypt -f report.txt -o report.txt.fal --compress

# Force overwrite, skip storing metadata
falencrypt -f data.bin -o data.bin.fal --force --no-mtime --no-mode

# Restore using the authenticated stored filename
faldecrypt -f out.fal -o .

# Explicit output path
faldecrypt -f out.fal -o decrypted.bin

# Rename on decrypt
faldecrypt -f out.fal -o dir/ --name renamed.bin

# Brute-force short PINs
falpass -f lost.fal -c "0123456789" -m 1 -M 4 -o recovered.bin

# Wordlist-combination mode
falpass -f lost.fal -w words.txt -W 4 \
    --seps none,-,_ --case lower,UPPER -o out

# Benchmark throughput + feasibility
falpass -f lost.fal -B

#include <fal_encrypt.hpp>
#include <fal_decrypt.hpp>

// Encrypt
fal::fal_encrypt_file("plain.txt", "plain.txt.fal", {
    .password = "s3cret",
    .chunk_size = 4194304,   // 4 MiB default
    .compress = true,
});

// Decrypt
fal::fal_decrypt_file("plain.txt.fal", ".", {
    .password = "s3cret",
});

Audited, fuzzed, and hardened

Every security finding from the adversarial audit has been patched, regression-tested, and verified with live probes under ASan/UBSan. Here are the guarantees.

Audit Findings (all patched or verified impossible)

Resource-accounted quantum attack estimates

The naive 2¹²⁸ Grover bound is a strict lower bound. A real attack must evaluate the full verification circuit, pay for logical qubits, error correction, and circuit depth. Resource-accounted figures below assume 10¹⁵ logical gates/s, ×10³ error correction overhead.

The practical takeaway: the cryptographic primitive is safe on any roadmap. The password is the real attack surface. ≥ 128-bit entropy passwords keep even a 10⁹-machine Grover descent above 10⁴–10⁵ years, and Argon2id's quantum memory requirement (2²⁹ logical qubits at 64 MiB) makes the cost even higher in practice.

Everything in one repository

Reference implementation in C++20. The permutation, sponge, KDF, crypto layer, format parser, encrypt/decrypt APIs, CLI tools, 16 test suites, fuzz harnesses, and the full audit record.

Empirical Certification Results

Measured across all 1024 input bits of the permutation.