Giblex exists for sovereignty.

Why open source matters

Closed-source security tools ask you to trust the vendor. Open-source security tools let you verify the vendor. Every cryptographic primitive, every data flow, every access boundary in the Phantom Suite is published and reviewable.

• Full source for vault encryption, key derivation, and attestation
• Public CI/CD pipelines — what you build matches what we ship
• Software Bill of Materials (SBOM) with every release
• Issue tracking, changelogs, and contribution guidelines

Code you can read

Here is how Phantom Obscura derives encryption keys — HKDF-SHA256 with domain separation ensures each key path is cryptographically independent.

// HKDF-SHA256 key derivation with domain separation
// Hand-rolled Extract + Expand via HMACSHA256

public static byte[] Sha256(
    byte[] ikm, byte[] salt, byte[] info,
    int len = 32)
{
    using var hmac = new HMACSHA256(salt);
    var prk = hmac.ComputeHash(ikm);

    hmac.Key = prk;   // re-key for Expand
    var block = hmac.ComputeHash(
        info.Concat(new byte[] { 1 }).ToArray());
    return block[..len];
}

// Per-container and per-file key derivation
var cek = Hkdf.Sha256(masterKey, salt,
    "container::cek"u8.ToArray());
var kek = Hkdf.Sha256(masterKey, salt,
    "kek"u8.ToArray());