Skip to content

Haldir v0.2.1 — AES-256-GCM Vault

Choose a tag to compare

View all tags
@ExposureGuard ExposureGuard released this 18 Apr 20:26
· 89 commits to main since this release
v0.2.1
c6e0da1

Vault upgraded to AES-256-GCM

Prior: AES-128-CBC + HMAC-SHA256 (Fernet).
Now: AES-256-GCM with additional authenticated data (AAD) binding each ciphertext to its (tenant_id, secret_name).

What this means for buyers

"AES-256-GCM at rest" is a compliance checklist item on every serious enterprise procurement review. Saying AES-128 previously cost a meaningless objection; making it AES-256 is accurate and stronger.

What this means for security

AAD binding means an attacker with DB write access can no longer:

  • Move a ciphertext between tenants
  • Rename a ciphertext under the same tenant

Decryption fails with InvalidTag in both cases — a defense-in-depth layer the old Fernet setup didn't have.

Breaking change

Existing Fernet ciphertexts are not decryptable by the new code. Self-hosted deployments upgrading from v0.2.0 must rotate every stored secret. The hosted service had no external-user secrets at upgrade time, so no action needed there.

Smoke-tested

6 cases: roundtrip, cross-tenant swap rejection, name-swap rejection, wrong-key rejection, raw-key and base64url key formats. All pass.

Full changelog: CHANGELOG.md

Assets 2
Loading