skvdb

High-performance encrypted key-value store written in Rust.

Current release: v0.1.0 — Encrypted Session Foundation

skvdb is an experimental Linux-focused key-value database designed around high-performance asynchronous I/O, a custom binary wire protocol, and cryptographically protected network communication.

The current release establishes the network and cryptographic foundation. The KV protocol, encrypted application frames, WAL, and io_uring storage engine are under active development.

Status: Early development / experimental

✨ Features

Currently implemented

• 🦀 Rust implementation
• ⚡ Tokio asynchronous TCP networking
• 🔌 Custom binary wire protocol
• 🔑 Ephemeral X25519 key exchange
• 🔐 HKDF-SHA256 session key derivation
• 🛡️ ChaCha20-Poly1305 AEAD primitives
• ↔️ Independent client-to-server and server-to-client keys
• 🔢 Directional nonce counters
• 📦 Maximum frame-size enforcement
• ⏱️ Handshake timeout protection
• 🧩 Structured protocol, cryptographic, and network errors

Planned

• 🔒 Fully encrypted request/response transport
• 📥 GET operations
• 📤 SET operations
• 🗑️ DELETE operations
• 💾 Write-Ahead Log (WAL)
• ⚡ io_uring-based storage I/O
• 🗄️ Persistent storage engine
• 🛡️ Linux systemd sandboxing
• 🧪 Comprehensive integration and protocol tests
• 📊 Benchmarking and performance analysis

🏗️ Architecture

The current network architecture is:

                    TCP
                     │
                     ▼
              Custom Framing
                     │
                     ▼
              X25519 Handshake
                     │
                     ▼
               Shared Secret
                     │
                     ▼
                HKDF-SHA256
                  /       \
                 /         \
                ▼           ▼
             C2S Key      S2C Key
                │           │
                └─────┬─────┘
                      ▼
             ChaCha20-Poly1305
                      │
                      ▼
              Encrypted Transport
                      │
                      ▼
                 KV Protocol
                      │
                      ▼
                Storage Engine
                      │
                      ▼
                    WAL
                      │
                      ▼
                  io_uring

The storage and encrypted application-layer transport are still under development.

🔐 Cryptographic Design

The initial handshake uses ephemeral X25519 keys.

After the Diffie-Hellman exchange, the resulting shared secret is expanded using HKDF-SHA256 into two independent 256-bit symmetric keys:

X25519 shared secret
        │
        ▼
   HKDF-SHA256
      /     \
     ▼       ▼
   C2S       S2C
    │         │
    ▼         ▼
ChaCha20   ChaCha20
Poly1305   Poly1305

Separate directional keys prevent the same key from being used for both directions of a connection.

Nonces are generated from monotonically increasing per-direction counters.

Important: The current cryptographic layer is a transport foundation, not a complete authenticated identity or production security protocol. Authentication, key confirmation, protocol version negotiation, replay semantics, and other security properties are still being designed.

📡 Wire Protocol

The base frame header is currently:

┌──────────┬────────────────────┐
│ Opcode   │ Payload Length     │
│ 1 byte   │ 4 bytes, BE        │
└──────────┴────────────────────┘

Current opcodes:

Opcode	Operation
0x01	HandshakeInit
0x02	HandshakeResp
0x10	KV Get
0x11	KV Set
0x12	KV Delete
0xFF	Error

The KV operations are reserved in the protocol but are not implemented yet.

🚀 Building

Requirements

• Rust stable
• Cargo
• Linux

Clone the repository:

git clone https://github.com/foxhackerzdevs/skvdb.git
cd skvdb

Build:

cargo build --release

Run:

./target/release/skvdb

The development server currently listens on:

127.0.0.1:8080

🧪 Development

Check the project:

cargo check

Format:

cargo fmt

Build tests:

cargo test

Release build:

cargo build --release

🗺️ Roadmap

Phase 1 — Network Foundation

• Tokio TCP listener
• Custom binary framing
• X25519 handshake
• HKDF-SHA256 key derivation
• Directional ChaCha20-Poly1305 keys
• Nonce counter
• Encrypted frame transport
• Protocol versioning
• Authentication/key confirmation

Phase 2 — KV Protocol

• GET
• SET
• DELETE
• Request IDs
• Response/error protocol
• Concurrent request handling

Phase 3 — Storage Engine

• In-memory KV engine
• WAL
• Crash recovery
• Checksums
• Persistence
• Compaction

Phase 4 — High-Performance I/O

• io_uring integration
• Async WAL writes
• Batched I/O
• Zero/minimal-copy data paths
• Performance benchmarks

Phase 5 — Linux Security

• systemd service
• Capability restrictions
• Filesystem isolation
• Device isolation
• Kernel hardening
• Resource limits

⚠️ Security Notice

skvdb is experimental software.

The cryptographic primitives are based on established algorithms and are implemented using the Rust ring library, but the overall protocol has not yet undergone a security audit.

Do not use the current development version for sensitive or production data.

Security issues should be reported privately to the maintainers whenever possible.

📈 Performance

Performance is a primary design goal, but benchmarks will only be published once the storage engine and encrypted request/response path are implemented.

The project aims to explore:

• asynchronous network concurrency
• efficient binary framing
• minimal allocations
• authenticated encryption
• batched storage operations
• Linux io_uring
• high-throughput WAL persistence

Performance claims will be based on reproducible benchmarks rather than assumptions.

📜 License

Licensed under the Apache License, Version 2.0.

See LICENSE for the full license text.

👨‍💻 Author

Abhrankan Chakrabarti

Part of the Fox Hackerz project ecosystem.

Build. Break. Secure.

This site is open source. Improve this page.