<b>cryptoflex v0.5.4: A Security-Hardened Local-First Crypto-Agility Policy Engine for Hybrid Classical and Post-Quantum Key Exchange</b>

Most encryption tools select a single cryptographic stack at build time and never revisit that decision, creating a maintainability and security liability as algorithms are deprecated or broken. While large-scale network protocols such as Signal’s PQXDH and Chrome’s X25519Kyber768 have already shipped hybrid classical+PQC key exchange, the local-first domain — file encryption utilities, desktop applications, and embedded/IoT systems — remains underserved.<br><br>This paper presents cryptoflex v0.5.4, a security-hardened local-first crypto-agility policy engine for Python that orchestrates existing, independently audited cryptographic primitives behind a runtime decision layer.

The system combines classical X25519 elliptic-curve Diffie-Hellman with NIST-standardized Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) via the Open Quantum Safe (liboqs) library. A versioned, bundled risk table enables algorithm deprecation without network dependency. A deterministic hybrid combiner binds all shared secrets and ciphertexts into a single 256-bit root key via HKDFSHA384 with injective length-prefixed encoding, achieving the standard “at-least-as-strongas-the-strongest-component” design goal.</p>