Where it’s meant to run
Anywhere the device is small, the battery is old, the link drops packets, and replacing the hardware is not on the table. Utilities and industrial controls come first, because that is where the idea started.
Five places it fits
Find yours. If it isn’t here, ask.
Utilities & Municipal Controls
Gas sensors, water meter shut-offs, power cut-offs, remote disconnects. These devices decide whether a house has gas, water and power. If someone takes over a city’s controls, that is not a data breach. It is an outage with consequences.
- 40-byte self-contained context, no heap or static
.bss - One message, one packet
- Built for the sub-GHz links these devices already use
- A firmware change instead of a truck roll, where the device can take an update
Industrial IoT & Remote SCADA
PLCs with almost no memory, pipeline monitoring stations, and remote sensors on LoRa, Sigfox or proprietary 915 MHz links.
- Leaves RAM free for sensor buffers
- A message is never split across packets, so there is less to resend
- Nothing added to the frame, so duty-cycle limits stay intact
- Less radio time per message means more battery
Tactical Edge Hardware & Perimeter Sensors
Size, weight and power decide what a soldier or a platform can carry. Less crypto overhead means a smaller board, a smaller battery, and fewer things to replace. Think unattended ground sensors, access tokens and battlefield telemetry nodes.
- No data-dependent branches or tables in the keystream path, plus hardware side-channel hardening (
CPA |r| = 0.0024) - 256-byte forward-secrecy keyframe ratcheting against physical node capture
- Reference implementation available under evaluation NDA
UAV Flight Controllers & Swarm Links
Cortex-M and RISC-V flight controllers and the radio links between aircraft.
- Same cycle count per byte, so the cipher adds no timing jitter of its own
- No heap, stack only
- Short control messages stay short
LEO & Remote Satellite Telemetry
Telemetry downlinks where every byte of the frame costs link budget.
- Ciphertext adds no bytes to the frame
- Continuous keystream, no block boundaries to pad
- No heap to corrupt on a system you can’t reboot by hand
Drop it into the firmware you already have
Single header. No external dependencies. No OS calls.
No heap (40-byte context)
Everything lives in a 40-byte self-contained instance and on the call stack. Zero malloc, zero free, zero static .bss.
One header
One header file, no external dependencies, no background threads, plus compile-time module selection and target-architecture guards.
With an RTOS or without one
No OS calls. Use it from a bare-metal loop or a task in FreeRTOS, Zephyr, ESP-IDF or STM32Cube.
In place & fast
Encrypt and decrypt directly in ring buffers, DMA buffers and radio FIFOs with 1:1 byte-stream density and optional 4x to 8x word-rate (W64) acceleration.
SDK availability: The reference C/C++ implementation, integration headers, test harnesses and unit tests go to qualified partners and defense contractors under the Apex Evaluation NDA.