Experimental Rust encrypted-container implementation with AES-256-XTS, Argon2id, and optional ML-KEM-768 key wrap. Linux file containers are the first working path; Windows and system encryption are not ready.
v0.2 — experimental. Not independently audited. Do not use it for irreplaceable data. Bug reports and test results are welcome.
- Native format: DC01 — AES-256-XTS + Argon2id + BLAKE3 header MAC
- Compat: mount some VeraCrypt/TrueCrypt volumes (AES-XTS path; incomplete cipher/cascade coverage)
- PQ extras: ML-KEM-768 wrapping for key export, not a post-quantum disk cipher
- UI:
dcCLI +devicecryptoriced GUI - Ops: password change, header backup/restore, human sizes, silent password prompts
This is not a VeraCrypt replacement and is not “post-quantum-ready.” See Assurance.
cargo build -p dc-cli --release
./target/release/dc create ./test.dc --size 16M --password 'test-pass' --fs fat32
mkdir mnt
# Mount: password (+ optional --keyfile). Dismount: id only — no password.
./target/release/dc mount ./test.dc ./mnt --password 'test-pass'
echo hi > ./mnt/hi.txt
./target/release/dc dismount
./scripts/linux-test.sh # full harness# Silent prompt (preferred over --password on shared machines)
./target/release/dc mount ./test.dc ./mnt
# Change password without re-encrypting data
./target/release/dc chpasswd ./test.dc
# Header safety net before experiments
./target/release/dc header backup ./test.dc ./test.hdrbak
./target/release/dc header restore ./test.dc ./test.hdrbak
./target/release/dc status
./target/release/dc info ./test.dcPassword tip: omit --password to type it silently. Prefer --password-env over --password (avoids argv leaks).
cargo build -p dc-gui --release
./target/release/devicecryptorTabs: Create, Mount, Dismount, Info, Status, Favorites, Keywrap — same operations as dc (keyfiles, PIM, hidden volumes, wipe, FS type, protect-hidden, ML-KEM wrap).
Workflow: mount asks for password (and optional keyfile); dismount is one click on Status (or enter mount id on Dismount) — no credentials again.
See docs/LINUX_TESTING.md, docs/ASSURANCE.md, docs/ROADMAP.md, CHANGELOG.md.
| Crate | Role |
|---|---|
dc-crypto |
AES-XTS, Argon2id, PBKDF2, ML-KEM |
dc-format |
DC01 + VeraCrypt headers |
dc-volume |
create/mount/sector I/O, FAT checkout, favorites, hidden volumes, chpasswd |
dc-platform |
OS helpers |
dc-cli |
dc binary |
dc-gui |
iced GUI |
See docs/UPSTREAM_MAP.md, docs/FORMAT.md (working spec), docs/THREAT_MODEL.md (draft).
DeviceCryptor is a new cryptographic product (unaudited). Primitive crates (aes, argon2, ml-kem, getrandom) are used rather than hand-rolled ciphers, but composition, format, and mount path are not independently reviewed.
| In tree now | Not yet |
|---|---|
Unit tests, Linux e2e harness, cargo audit in CI |
Independent cryptographic review |
Header libFuzzer target (fuzz/) |
Differential tests vs known-good AES-XTS / ML-KEM implementations |
| Working DC01 layout notes | Frozen format specification |
| Draft threat model | Side-channel review; corruption/recovery campaign |
Stronger language (“rewrite of VeraCrypt”, “post-quantum-ready”, production use) waits on the gates in docs/ASSURANCE.md and docs/AUDIT.md.
DeviceCryptor original code is licensed under the Apache License 2.0. Copyright © 2026 Vassbrekke AS. See LICENSE and NOTICE.
Source: https://github.com/Vassbrekke/DeviceCryptor
Vendor trees under vendor/ keep their own licenses (VeraCrypt / TrueCrypt terms, VeraCrypt-DCS LGPL-3.0) — see NOTICE. They are reference-only and are not linked into DeviceCryptor release binaries.