mirror of
https://github.com/hanzoai/cek.git
synced 2026-10-09 02:37:18 +00:00
zeekayandHanzo Dev
f9255eacf9
A key derived from the master and the namespace: not generated, not wrapped, not stored, not rotated in place. That removes the unwrap step, the rewrap step, the per-file key material, and the plaintext-to-encrypted migration — every one of which existed to carry old data forward, and none of which is a property anyone wanted. A database is born encrypted or it does not exist. The same namespace and subsystem always derive the same key, so a file reopens after a restart with nothing persisted beside it, and two databases never share a key because the subsystem is part of the binding. Losing the master loses the data. That is what encryption at rest means, and why the master lives in KMS. Co-authored-by: Hanzo Dev <[email protected]>
26 lines
808 B
AMPL
26 lines
808 B
AMPL
module github.com/hanzoai/cek
|
|
|
|
go 1.26.5
|
|
|
|
require (
|
|
github.com/hanzoai/namespace v1.2.0
|
|
github.com/hanzoai/sqlite v0.4.0
|
|
golang.org/x/crypto v0.54.0
|
|
)
|
|
|
|
require (
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518 // indirect
|
|
github.com/hanzoai/csqlite v0.1.0 // indirect
|
|
github.com/hanzoai/sqlcipher v0.1.1 // indirect
|
|
github.com/luxfi/crypto v1.20.2 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
modernc.org/libc v1.72.3 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
modernc.org/sqlite v1.51.0 // indirect
|
|
)
|