cek

README

cek

Opens a namespace's SQLite database encrypted at rest.

db, err := cek.Open(master, ns, "treasury", dataDir)

The key is derived from the master and the namespace. It is not generated, not wrapped, not stored, and not rotated in place — so there is no unwrap step, no rewrap step, no per-file key material to lose, and no migration path to maintain. A database is born encrypted or it does not exist.

Losing the master loses the data. That is the property you want from encryption at rest, and the reason the master lives in KMS.

Where it sits

hanzoai/namespace	names the entity, and where its file lives
hanzoai/cek	turns the master + that name into the file's key, and opens it
hanzoai/sqlite	opens a file under a raw key; knows nothing about who owns it
hanzoai/kms	holds the master

Nothing here knows about orgs, users, billing or plugins. It knows a namespace, a subsystem, and a master key.

Documentation

Overview

Package cek opens a namespace's SQLite database encrypted at rest.

There is one way to do it:

db, err := cek.Open(master, ns, "treasury", dataDir)

The key is derived from the master and the namespace. It is not generated, not wrapped, not stored, and not rotated in place — so there is no unwrap step, no rewrap step, no per-file key material to lose, and no migration path to maintain. A database is born encrypted or it does not exist. Losing the master loses the data, which is the property you want from encryption at rest and the reason the master lives in KMS.

The split of responsibilities is deliberate:

namespace  names the entity and where its file lives
cek        turns the master + that name into the file's key, and opens it
sqlite     opens a file under a raw key and knows nothing about who owns it
kms        holds the master

Nothing here knows about orgs, users, billing or plugins. It knows a namespace, a subsystem, and a master key.

Index

• Constants
• Variables
• func DeriveKey(master []byte, ns namespace.Namespace, subsystem string) ([]byte, error)
• func Open(master []byte, ns namespace.Namespace, subsystem, dir string) (*sql.DB, error)

Constants

const KeyLen = 32

KeyLen is the length of both the master key and every derived key.

Variables

var ErrNoMaster = errors.New("cek: master key must be " + itoa(KeyLen) + " bytes")

ErrNoMaster reports a master key that is missing or the wrong length. It is deliberately fatal to Open rather than falling back to plaintext: a service that starts unencrypted because a key was absent has failed silently at the only job this package has.

Functions

func DeriveKey

func DeriveKey(master []byte, ns namespace.Namespace, subsystem string) ([]byte, error)

DeriveKey returns the key for one database: the master, bound to the namespace that owns it and the subsystem it holds.

It is a pure function of its inputs. The same namespace and subsystem always produce the same key, so a file can be opened again after a restart with nothing persisted alongside it, and two different databases never share a key because the subsystem is part of the binding.

func Open

func Open(master []byte, ns namespace.Namespace, subsystem, dir string) (*sql.DB, error)

Open opens the encrypted database holding subsystem for ns, under dir, creating it if it does not exist. The returned handle is already keyed; callers use it as an ordinary *sql.DB.

The error never contains the key or a DSN that holds it.