[opensourcedex]

charm is a free, open source design & prototyping project written in Python and released under LGPL-3.0. It has 649 GitHub stars, 169 forks and 9 open issues, and was last pushed 9 days ago. On this registry it ranks #22 of 23 tracked projects in Design & Prototyping, with 5 head-to-head comparisons available.

What is charm?

Charm (Charm-Crypto) is a Python-based framework for rapidly prototyping advanced cryptosystems — attribute-based encryption, identity-based encryption, pairing-based schemes, threshold ECDSA, and zero-knowledge proofs — built for researchers and engineers who need working schemes without hand-writing the underlying mathematics.

What it is

Charm is an LGPL-3.0 framework from JHUISI for rapidly prototyping advanced cryptosystems. Design is hybrid: performance-intensive mathematical operations live in native C modules; the cryptosystems themselves are written in readable, high-level Python. Goal from the ground up: minimize development time and code complexity, promote reuse of components. Repo ships additional components meant to speed construction of new schemes and protocols. Topics: cryptography, prototyping, python. Requirements: Python 3.8 through 3.14, Linux, macOS, or Windows, OpenSSL 3.0+.

Problem it solves: replaces months of hand-written pairing math and protocol plumbing with reusable building blocks. Instead of implementing BLS12-381 bilinear pairings, Cramer-Shoup, or a threshold ECDSA signing round from scratch, a developer composes named schemes out of library primitives. Charm lives in the Python cryptography ecosystem and sits above lower-level native libraries such as PBC, which it uses for efficient bilinear pairing implementation.

Key capabilities

  • Advanced encryption schemes: Ciphertext-Policy ABE (BSW07, Waters09, FAME), Key-Policy ABE (LSW08, GPSW06), multi-authority and decentralized ABE for fine-grained access control, plus identity-based encryption (Waters05, Boneh-Boyen BB04, Boneh-Franklin).
  • Pairing-based cryptography: BN254 and BLS12-381 curves at roughly 128-bit security, with efficient bilinear pairing implementation via the PBC library.
  • Signature and public-key encryption library: BLS (Ethereum 2.0), Waters, CL04, Boyen, ECDSA, Schnorr, EdDSA, RSA, DSA, Lamport, BLS aggregation, MuSig, plus ElGamal, RSA, Paillier (homomorphic), and Cramer-Shoup.
  • Threshold ECDSA for t-of-n distributed signing: GG18 (Paillier-based), CGGMP21 (UC-secure with identifiable aborts), and DKLS23 (non-interactive presigning with OT-based MtA), supporting secp256k1 for Bitcoin and XRPL plus other curves.
  • Zero-knowledge proof compiler for interactive and non-interactive proofs: Schnorr proofs, Discrete Log Equality (DLEQ), Knowledge of Representation, AND/OR composition, range proofs via bit decomposition, and batch verification.
  • Optional post-quantum and lattice module backed by NTL: Ring-LWE public key encryption (LPR), Kyber-style KEM, Dilithium-style signatures, lattice-based IBE (ABB10), and polynomial ring arithmetic in R_q = Z_q[X]/(X^n+1).
  • Infrastructure and tooling: protocol engine for multi-party protocols, base crypto library (AES, hash functions, PRNGs), C/C++ embed API through the Python C API, mathematical settings for integer rings, fields, and bilinear and non-bilinear elliptic curve groups, and integrated benchmarking.

Who uses it and how

  • Cryptography researchers prototyping new schemes, reusing ABE, IBE, and pairing components rather than rebuilding curve and field arithmetic per project.
  • Protocol engineers building threshold signing systems, running t-of-n threshold ECDSA over secp256k1 where no single party holds the full key, using GG18, CGGMP21, or DKLS23.
  • Teams that need policy-based access control at the encryption layer, wiring CP-ABE or KP-ABE into a data-sharing workflow.
  • Developers who need zero-knowledge proofs — Schnorr, DLEQ, knowledge of representation, or range proofs — without writing a circuit compiler.
  • Native C/C++ applications that embed Charm through the Python C API, and groups measuring scheme performance with the built-in benchmarking harness.

Getting started

Install with the one-line script: curl -sSL https://raw.githubusercontent.com/JHUISI/charm/dev/install.sh | bash, which handles system dependencies and installs from PyPI by default; pass --from-source for a development install. Documentation lives at https://jhuisi.github.io/charm/.

How it compares

The facts name no comparable or paid products this project replaces, so Charm stands alone in this registry as the prototyping framework for advanced cryptosystems. No licence, hosting, or cost-model contrast can be drawn from the material provided.

When to use it — and when not to

Use Charm when the task is prototyping or researching advanced schemes and the team can operate a native build toolchain: the install script pulls system dependencies, the framework requires OpenSSL 3.0+, and the optional lattice module depends on NTL. Do not pick it as a drop-in production signing service or as a substitute for audited, standards-certified crypto — the lattice schemes are explicitly optional and described as simplified ML-KEM and ML-DSA implementations, and Post-Quantum support is not in the default path. Self-hosters must also review the piped remote install script before running it, since it executes system-level dependency installation.

project readme (upstream, from github) — read inline

Charm-Crypto

Branch Status
dev Build Status

Charm is a framework for rapidly prototyping advanced cryptosystems. Based on the Python language, it was designed from the ground up to minimize development time and code complexity while promoting the reuse of components.

Charm uses a hybrid design: performance-intensive mathematical operations are implemented in native C modules, while cryptosystems themselves are written in a readable, high-level language. Charm additionally provides a number of new components to facilitate the rapid development of new schemes and protocols.

Features

Advanced Cryptographic Schemes

  • Attribute-Based Encryption (ABE): Fine-grained access control encryption
    • Ciphertext-Policy ABE (CP-ABE): BSW07, Waters09, FAME
    • Key-Policy ABE (KP-ABE): LSW08, GPSW06
    • Multi-Authority ABE, Decentralized ABE
  • Identity-Based Encryption (IBE): Encryption using identities as public keys
    • Waters05, Boneh-Boyen (BB04), Boneh-Franklin
  • Pairing-Based Cryptography: BN254, BLS12-381 curve support (~128-bit security)
    • Bilinear pairings for advanced protocols
    • Efficient implementation via PBC library
  • Digital Signatures: Comprehensive signature scheme library
    • Pairing-based: BLS (Ethereum 2.0), Waters, CL04, Boyen
    • Elliptic curve: ECDSA, Schnorr, EdDSA
    • Standard: RSA, DSA, Lamport
    • Aggregate/Multi-signatures: BLS aggregation, MuSig
  • Public-Key Encryption: Standard and advanced PKE schemes
    • ElGamal, RSA, Paillier (homomorphic), Cramer-Shoup
  • Post-Quantum / Lattice-Based Cryptography: NTL-backed lattice schemes (optional module)
    • Ring-LWE Public Key Encryption (LPR)
    • Kyber-style KEM (simplified ML-KEM / FIPS 203)
    • Dilithium-style Signatures (simplified ML-DSA / FIPS 204)
    • Lattice-based Identity-Based Encryption (ABB10)
    • Polynomial ring arithmetic in R_q = Z_q[X]/(X^n+1)
  • Commitments & Secret Sharing: Pedersen commitments, Feldman/Pedersen VSS

Threshold Cryptography / MPC

  • Threshold ECDSA: Production-ready t-of-n distributed signing
    • GG18 (Gennaro-Goldfeder 2018) — Classic Paillier-based threshold ECDSA
    • CGGMP21 (Canetti et al. 2021) — UC-secure with identifiable aborts
    • DKLS23 (Doerner et al. 2023) — Non-interactive presigning with OT-based MtA
    • Supports secp256k1 (Bitcoin, XRPL) and other curves

Zero-Knowledge Proofs

  • ZKP Compiler: Production-ready compiler for interactive and non-interactive proofs
    • Schnorr proofs, Discrete Log Equality (DLEQ)
    • Knowledge of Representation proofs
    • AND/OR composition for complex statements
    • Range proofs via bit decomposition
    • Batch verification for improved performance

Infrastructure & Tools

  • Mathematical Settings: Integer rings/fields, bilinear and non-bilinear EC groups
  • Base Crypto Library: Symmetric encryption (AES), hash functions, PRNGs
  • Protocol Engine: Simplifies multi-party protocol implementation
  • C/C++ Embed API: Native applications can embed Charm via the Python C API
  • Integrated Benchmarking: Built-in performance measurement

Requirements

Component Supported Versions
Python 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14
Operating Systems Linux, macOS, Windows
OpenSSL 3.0+

Installation

One-Line Install (Recommended)

The easiest way to install Charm is using the automated install script, which handles all system dependencies:

curl -sSL https://raw.githubusercontent.com/JHUISI/charm/dev/install.sh | bash

Supported platforms:

  • Ubuntu/Debian (and derivatives: Linux Mint, Pop!_OS)
  • Fedora/RHEL/CentOS (and derivatives: Rocky, Alma, Oracle Linux)
  • Arch Linux (and derivatives: Manjaro, EndeavourOS)
  • macOS (Intel and Apple Silicon)

Install options:

# Default: install from PyPI (recommended)
curl -sSL ... | bash

# Install from source (for development)
curl -sSL ... | bash -s -- --from-source

# Only install system dependencies (for manual pip install)
curl -sSL ... | bash -s -- --deps-only

# See all options
./install.sh --help

Quick Install (pip)

If you prefer to install dependencies manually:

pip install charm-crypto-framework

Note: System libraries (GMP, PBC, OpenSSL) must be installed first. See Prerequisites below.

Prerequisites

Charm requires the following system libraries:

Library Version Purpose
GMP 5.0+ Arbitrary precision arithmetic
PBC 1.0.0 Pairing-based cryptography
OpenSSL 3.0+ Cryptographic primitives
NTL 11.0+ Lattice-based cryptography (optional)

Ubuntu/Debian:

sudo apt-get install libgmp-dev libssl-dev libpbc-dev flex bison

# Optional: for lattice-based crypto module
sudo apt-get install libntl-dev

macOS (Homebrew):

brew install gmp openssl@3 pbc

# Optional: for lattice-based crypto module
brew install ntl

PBC from Source (if not available via package manager):

wget https://crypto.stanford.edu/pbc/files/pbc-1.0.0.tar.gz
tar xzf pbc-1.0.0.tar.gz
cd pbc-1.0.0
./configure && make && sudo make install

NTL from Source (if not available via package manager):

wget https://libntl.org/ntl-11.6.0.tar.gz
tar xzf ntl-11.6.0.tar.gz
cd ntl-11.6.0/src
./configure NTL_GMP_LIP=on SHARED=on
make && sudo make install

From Source (Development)

git clone https://github.com/JHUISI/charm.git
cd charm
./configure.sh  # add --enable-darwin on macOS
pip install -e ".[dev]"

To include the lattice-based crypto module (requires NTL):

./configure.sh --enable-lattice  # add --enable-darwin on macOS
LAT_MOD=yes pip install -e ".[dev]"

Verify Installation

python -c "from charm.toolbox.pairinggroup import PairingGroup; print('Charm installed successfully\!')"

Testing

Charm includes comprehensive test suites:

# Run all tests
make test-all

# Run specific test categories
make test-unit       # Unit tests (toolbox, serialize, vectors)
make test-schemes    # Cryptographic scheme tests
make test-zkp        # ZKP compiler tests
make test-adapters   # Adapter tests
make test-embed      # C/C++ embed API tests

# Threshold ECDSA tests (GG18, CGGMP21, DKLS23)
pytest charm/test/schemes/threshold_test.py -v -k "GG18 or CGGMP21 or DKLS23"

# Run with coverage
pytest --cov=charm charm/test/ -v

Documentation

Quick Examples

BLS Signatures (Pairing-Based)

BLS signatures (Boneh-Lynn-Shacham) — standardized in IETF RFC 9380 and used in Ethereum 2.0:

from charm.toolbox.pairinggroup import PairingGroup
from charm.schemes.pksig.pksig_bls04 import BLS01

# Initialize pairing group (BN254 curve, ~128-bit security)
group = PairingGroup('BN254')
bls = BLS01(group)

# Ethereum 2.0 validator attestation
attestation = {'slot': 1234, 'epoch': 38, 'beacon_block_root': '0xabc...'}

(pk, sk) = bls.keygen()
signature = bls.sign(sk['x'], attestation)
assert bls.verify(pk, signature, attestation)

ECDSA with secp256k1 (Bitcoin)

ECDSA on secp256k1 — the curve used by Bitcoin (SEC 2, BIP-340):

import hashlib
import json
from charm.toolbox.ecgroup import ECGroup
from charm.toolbox.eccurve import secp256k1
from charm.schemes.pksig.pksig_ecdsa import ECDSA

group = ECGroup(secp256k1)
ecdsa = ECDSA(group)

# Bitcoin transaction (simplified)
tx = {
    'inputs': [{'txid': 'a1b2c3...', 'vout': 0, 'address': '1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa'}],
    'outputs': [{'address': '3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy', 'satoshis': 50000}],
    'fee': 1000
}

# Serialize and double SHA-256 (SHA-256d) per Bitcoin protocol
tx_bytes = json.dumps(tx, sort_keys=True).encode('utf-8')
tx_hash = hashlib.sha256(hashlib.sha256(tx_bytes).digest()).hexdigest()

(pk, sk) = ecdsa.keygen(0)
signature = ecdsa.sign(pk, sk, tx_hash)
assert ecdsa.verify(pk, signature, tx_hash)

Note: Production Bitcoin implementations should use proper transaction serialization per [Bitcoin Developer Documentation](https://developer.bitcoin.org/reference/tr

readme truncated — read the full docs on github

Frequently asked questions

Is charm free to use?

charm is open source under the LGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does charm do?

Charm: A Framework for Rapidly Prototyping Cryptosystems

What is charm written in?

charm is primarily written in Python. Its source is publicly available at https://github.com/JHUISI/charm, and it has 649 GitHub stars.