Kindi - Cryptographic Evidence Hunter
Author: copyleftdev
Description: High-performance cryptographic evidence scanner for embedded firmware and software supply chains. SIMD Aho-Corasick, Rayon parallel, 33-175x faster, 8 fuzz targets, zero unsafe.
Keywords: cryptography,scanner,SBOM,firmware,supply chain,security,Rust,SIMD,Aho-Corasick,crypto detection,compliance,embedded,FIPS,fuzzing,devsecops

kindi
GitHub

## Find the crypto
hiding in your firmware

SIMD-accelerated pattern matching across source trees, archives, and binaries. 93,000 files in under 1 second. 48+ algorithms. Zero unsafe.

$cargo install --git https://github.com/copyleftdev/kindiclick to copy
0
x faster
0
K files/sec
0
hits found
0
unsafe
performance

## Aho-Corasick vs
regex alternation

One automaton. One pass. SIMD inner loop. More patterns = bigger win.

operation | baseline | kindi |
--- | --- | --- | ---
keyword (434 patterns) | 10,814 us | 332 us | 33x
api (4,427 patterns) | 55,795 us | 318 us | 175x
throughput (keyword) | 6.1 MB/s | 199 MB/s | 33x
throughput (api) | 1.2 MB/s | 208 MB/s | 175x

detection

## 48+ algorithms.
Weak crypto flagged.

Word boundaries. Binary scanning. Evidence filtering. Keyword and API methods tracked separately.

#### Multi-pattern SIMD

4,800+ patterns in a single O(n) pass. No per-line regex.

#### Weak crypto flagging

DES, MD5, SHA-1, RC4, Blowfish flagged with NIST status.

#### Archive extraction

ZIP, TAR, GZ, BZ2, XZ, LZMA. SHA-256 cycle detection.

#### Binary scanning

--scan-binary with encoding fallback. UTF-8, Latin-1, lossy.

#### Word boundaries

\b enforced per-pattern. API mode forces whole-word.

#### Zero unsafe

Bounds-checked .get() on every hot-path index. 256 MB guard.

field test

## Four legendary
C monorepos

Identical pattern databases. Real codebases. Decades of history.

#### Linux kernel

93,188 files · 1.7 GB
hits0
time0.64s
rate146K/s

#### OpenSSL

6,098 files · 144 MB
hits0
time1.03s
rate5.9K/s

#### Wireshark

7,256 files · 357 MB
hits0
time1.40s
rate5.2K/s

#### FFmpeg

10,260 files · 112 MB
hits0
time0.38s
rate27K/s
why is the kernel fastest?
Linux
avg file 18 KB
hits/file 1.2
CPU util 2,574%
files/s 146K
FFmpeg
avg file 11 KB
hits/file 0.4
CPU util 453%
files/s 27K
OpenSSL
avg file 24 KB
hits/file 44.6
CPU util 755%
files/s 5.9K
Wireshark
avg file 49 KB
hits/file 6.7
CPU util 436%
files/s 5.2K
Small files + low match density + high parallelism. The kernel's 93K files average just 18 KB each -- tiny reads that Rayon distributes perfectly across all cores (2,574% CPU). OpenSSL is slowest per-file because every file is dense with crypto: 44.6 hits/file means constant line-lookup, context extraction, and result allocation. Wireshark's large XML protocol definitions (49 KB avg) bottleneck on raw byte throughput.
kernel crypto breakdown
ai agent output

## --toon
30,228:1 compression

100 MB JSON becomes 3 KB. Weak crypto pre-classified. Files pre-ranked. Methods pre-split. 1,200 kernel scans fit in one context window.

@kindi pkg=linux files=93188 hits=108010 matched=4909 t=0.934s #by_type count=8 AES 10804 908f drivers/crypto/atmel-aes.c:323 SHA2 3851 449f include/crypto/sha2.h:203 DES 2948 263f drivers/gpu/drm/amd/...:225 #weak count=4 DES 2948 263f DEPRECATED:NIST-withdrawn MD5 1193 219f BROKEN:collision-attacks SHA1 1364 330f DEPRECATED:NIST-2030 RC4 87 12f BROKEN:biased-keystream #hot top=3 1010 drivers/crypto/inside-secure/safexcel_cipher.c AES,DES,SHA1 940 drivers/crypto/axis/artpec6_crypto.c AES,SHA2,HMAC 927 drivers/md/dm-crypt.c AES,HMAC,MD5
26M
json tokens
864
toon tokens
0
ratio
integration testing

## 1,000 universes.
20 crypto types. Turmoil.

Each universe is a synthetic embedded system. Kindi must find every planted pattern. Turmoil adds encoding chaos, adversarial files, and deep nesting.

megaverse · 1,000 universes · 200 bars
0
universes
0
matches
0
crypto types
0
ms runtime
security

## 8 fuzz targets.
Structure-aware.

libFuzzer + Arbitrary. Every match asserted for bounds, boundaries, filtering, and output integrity.

#### fuzz_pattern_parse

Malformed INI+JSON. No panics.

#### fuzz_pattern_search

matched_text == content[begin..end]. Word boundaries enforced.

#### fuzz_extract_zip

Malformed ZIPs. No path traversal.

#### fuzz_extract_tar

Corrupt tar/gz/bz2/xz. No panics.

#### fuzz_encoding

Arbitrary bytes. Output always valid UTF-8.

#### fuzz_full_pipeline

End-to-end. JSON round-trips. CSV well-formed.

#### fuzz_path_sanitize

../ traversal, absolute paths, null bytes.

#### fuzz_language_classify

Exotic extensions, Unicode filenames.

origin · Baghdad, c. 850 CE

> "One way to solve an encrypted message, if we know its language, is to find a different plaintext of the same language long enough to fill one sheet or so, and then we count the occurrences of each letter."

Abu Yusuf Ya'qub ibn Ishaq al-Kindi — Risalah fi Istikhraj al-Mu'amma

The first human to systematically find patterns in encrypted text. We run his method at 200 MB/s.