mirror of
https://github.com/hanzoai/cek.git
synced 2026-10-09 02:37:18 +00:00
zeekayandHanzo Dev
c4e6f48000
A file's key comes from two joins: an owner and a file id joined into one identity, and a namespace and a subsystem joined into one info string. Both joins were described but never stated — the vectors took the pieces already joined, so they held for any way of joining them. These state them. Every expected value is a literal from an implementation of the scheme written separately from this one, in another language, from the original source: hanzoai/sqlite v0.4.0 and hanzoai/cloud v1.801.360. That implementation reproduces the vectors already here exactly, which is what makes it a reference rather than a second opinion. A sidecar sealed by it is opened here from nothing but a namespace and a file on disk, so the reader has to arrive at the owner and the file rather than be handed them. The encoding is read back by a reader written from its definition, over lengths that run past 128, where the length prefix grows a second byte, and past 16384, where it grows a third. The derivation is unchanged. Co-authored-by: Hanzo Dev <[email protected]>
cek
Opens a namespace's SQLite database encrypted at rest.
cek.SetMaster(k) // once, at boot, from KMS
db, err := cek.Open(ns, "treasury", dataDir) // everywhere else
The key is derived from the master and the namespace. It is not generated, not wrapped, not stored, and not rotated in place — so there is no unwrap step, no rewrap step, no per-file key material to lose, and no migration path to maintain. A database is born encrypted or it does not exist.
Losing the master loses the data. That is the property you want from encryption at rest, and the reason the master lives in KMS.
Where it sits
hanzoai/namespace |
names the entity, and where its file lives |
hanzoai/cek |
turns the master + that name into the file's key, and opens it |
hanzoai/sqlite |
opens a file under a raw key; knows nothing about who owns it |
hanzoai/kms |
holds the master |
Nothing here knows about orgs, users, billing or plugins. It knows a namespace, a subsystem, and a master key.