cyphera-swift

Data protection SDK for Swift — format-preserving encryption (FF1/FF3), data masking, and hashing.

.package(url: "https://github.com/cyphera-labs/cyphera-swift.git", from: "0.0.2-alpha.1")

Usage

import Cyphera

// Load configuration from file
let cyphera = try Cyphera.load()

// Protect data — the configuration decides the engine
let protected = try cyphera.protect("123-45-6789", configuration: "ssn")
// → "T01k7R-m2-9xPqR4n"

// Access data — header-based, no configuration name needed
let original = try cyphera.access(protected)
// → "123-45-6789"

Engines

Engine	Reversible	Description
ff1	Yes	NIST SP 800-38G FF1
ff3	Yes	NIST SP 800-38G Rev 1 FF3-1
mask	No	Simple pattern masking
hash	No	SHA-256/384/512, HMAC (coming soon)

Configuration File (cyphera.json)

{
  "configurations": {
    "ssn": {
      "engine": "ff1",
      "key_ref": "demo-key",
      "header": "T01"
    },
    "credit_card": {
      "engine": "ff1",
      "key_ref": "demo-key",
      "header": "T02"
    },
    "name": {
      "engine": "ff1",
      "alphabet": "alpha_lower",
      "key_ref": "demo-key",
      "header": "T03"
    }
  },
  "keys": {
    "demo-key": {
      "material": "2B7E151628AED2A6ABF7158809CF4F3C"
    }
  }
}

The header (Data Protection Header, DPH) is a short prefix prepended to protected output that identifies the configuration used. It lets access() reverse a value without the caller naming the configuration.

Primitives

For direct engine access without the configuration layer:

import Cyphera

let key = Data(hexString: "2B7E151628AED2A6ABF7158809CF4F3C")
let tweak = Data(count: 0)

let ff1 = try FF1(key: key, tweak: tweak, alphabet: "0123456789")
let encrypted = try ff1.encrypt("0123456789")   // "2433477484"
let decrypted = try ff1.decrypt("2433477484")   // "0123456789"

Cross-Language Compatible

All Cyphera SDKs produce identical output for the same key, tweak, and alphabet:

Input:       123-45-6789
Java:        T01i6J-xF-07pX
Rust:        T01i6J-xF-07pX
Python:      T01i6J-xF-07pX
Node:        T01i6J-xF-07pX
Swift:       T01i6J-xF-07pX

Platform Support

• macOS 10.15+, iOS 13+, tvOS 13+, watchOS 6+
• Linux (via CryptoSwift fallback)
• Uses native CommonCrypto/CryptoKit on Apple platforms for hardware-accelerated AES

Status

Alpha. API is unstable.

License

Apache 2.0 — Copyright 2026 Horizon Digital Engineering LLC