Skip to content

Master-key rotation for client-side AES-encrypted snapshots #8

@pathosDev

Description

@pathosDev

Encryption.deriveSubkey takes a single masterKey today. Rotation needs the manifest header to carry a key-version byte and the encrypt path to know which key is current. Decrypt picks the right master based on version. Out-of-scope work spelled out in BodyCodec.ts comments.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions