mikluko/baox
Watch
1
0
Code Issues 10 Projects Packages Wiki Activity Actions

seal, unseal: archives encrypted and signed through transit #9

New issue
Open
opened 2026-10-27 20:17:18 +00:00 by mikluko · 0 comments
mikluko commented 2026-10-27 20:17:18 +00:00
Owner
Copy link

Question

baox seal and baox unseal protect an archive kept in untrusted object storage:

  • seal: a data key from transit/datakey/plaintext/<key>, AES-256-GCM locally, the wrapped key stored beside the ciphertext, an ed25519 signature from transit/sign/<key> over the hashes of both.
  • unseal: transit/verify first, then transit/decrypt of the wrapped key, then decryption. A bad signature fails before anything is decrypted.

Streams, so an archive of several gigabytes does not need to fit in memory. Key names come from the config file.

## Question `baox seal` and `baox unseal` protect an archive kept in untrusted object storage: - seal: a data key from `transit/datakey/plaintext/<key>`, AES-256-GCM locally, the wrapped key stored beside the ciphertext, an ed25519 signature from `transit/sign/<key>` over the hashes of both. - unseal: `transit/verify` first, then `transit/decrypt` of the wrapped key, then decryption. A bad signature fails before anything is decrypted. Streams, so an archive of several gigabytes does not need to fit in memory. Key names come from the config file.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
No results found.
No results found.
Labels
Clear labels   
wayfinder:task
No labels
wayfinder:task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
mikluko/baox#9
No description provided.