Improve encryption for sensitive data in db #5

New issue

Open

opened 2026-02-19 17:56:31 +00:00 by eelke · 0 comments

eelke commented

2026-02-19 17:56:31 +00:00

Owner

Use simple binary storage

version smallint
blob

Probable need some rule that sizes can become variable length in the future by having first n bytes have highest bit set.
We might want to do AAD later on, this will be a new version so that could easily allow an extra size and field. If we want it
really future proof we could start with a bit mask.

bit 0, set if nonce present
bit 1, set if tag present
bit 2, set if aad present
cypher is allways present and last field

With each key store

id
keyData
createdAt

In future maybe other parameters

Use simple binary storage - version smallint - blob <nonce size><nonce><tag size><tag><cypher> Probable need some rule that sizes can become variable length in the future by having first n bytes have highest bit set. We might want to do AAD later on, this will be a new version so that could easily allow an extra size and field. If we want it really future proof we could start with a bit mask. - bit 0, set if nonce present - bit 1, set if tag present - bit 2, set if aad present - cypher is allways present and last field With each key store - id - keyData - createdAt In future maybe other parameters