mirror of
https://github.com/hanzoai/cek.git
synced 2026-10-09 02:37:18 +00:00
zeekayandHanzo Dev
d909c823f0
sqlite v0.5.0 removes DeriveKey, WrapDEK, UnwrapDEK and PrincipalAAD, which is right — a driver opens a file under a key it is handed and has no business deriving one. v0.2.2 borrowed exactly those to read a sidecar, so it cannot be built against v0.5.0, and taking v0.5.0 meant dropping back to v0.2.1: a cloud that derives a key for files whose key came from crypto/rand. But a format is not retired by the code that used to write it. The bytes on disk still have it, in 211 org directories. Key material is this package's concern, so this package states it: HKDF-SHA256 over the master bound to (principal, file id) by a length-prefixed info, AES-256-GCM with the version byte leading the AAD. Golden vectors produced under the original implementation pin every part of it — info composition, AAD, version byte, nonce split. A silent drift now fails a test instead of a volume. Still read-only: no wrap, no mint, no rewrite. The test seals its own fixtures because production never needs to. Builds and passes against sqlite v0.5.0 and v0.4.0 alike. Co-authored-by: Hanzo Dev <[email protected]>
cek
Opens a namespace's SQLite database encrypted at rest.
cek.SetMaster(k) // once, at boot, from KMS
db, err := cek.Open(ns, "treasury", dataDir) // everywhere else
The key is derived from the master and the namespace. It is not generated, not wrapped, not stored, and not rotated in place — so there is no unwrap step, no rewrap step, no per-file key material to lose, and no migration path to maintain. A database is born encrypted or it does not exist.
Losing the master loses the data. That is the property you want from encryption at rest, and the reason the master lives in KMS.
Where it sits
hanzoai/namespace |
names the entity, and where its file lives |
hanzoai/cek |
turns the master + that name into the file's key, and opens it |
hanzoai/sqlite |
opens a file under a raw key; knows nothing about who owns it |
hanzoai/kms |
holds the master |
Nothing here knows about orgs, users, billing or plugins. It knows a namespace, a subsystem, and a master key.