Envelope Encryption

Maskura can envelope-encrypt PII fields in supported processed objects. You hold the keys — Maskura never sees your private key.

How it works

Supported writes and opt-in processed reads run the configured processing pipeline. Two plugins matter here:

• PII detection — finds emails, credit-card numbers, SSNs, and similar fields in each record.
• Envelope encryption — replaces each detected PII value with an encrypted envelope:RSA-OAEP wraps a random AES-256-GCM data key, and the field is encrypted with that key. The envelope carries iv, enc_dek, ct, and tag.

Encryption only runs when your API key has a registered public key. Without one, Maskura redacts PII (replaces values with [REDACTED_EMAIL] etc.) but does not encrypt.

Set it up (3 steps)

1. Create an API key

In the dashboard → API Keys → Generate. You get an access key (s4_...) and a secret key (s4s_...).

2. Attach an encryption key

Click Set encryption key next to the key. The dashboard generates an RSA-2048 keypair in your browser:

• The private key is shown once — download or copy it now. Maskura never sees it.
• The public key is sent to Maskura and attached to your API key. The envelope-encrypt plugin can then encrypt detected fields on supported processed requests using that key.

If you generate a keypair yourself (e.g. openssl genrsa -out key.pem 2048), you can register the public half with:

curl -X PUT https://api.s4.231self.com/dashboard/api/keys/public-key \
  -H "Content-Type: application/json" \
  -H "x-maskura-access-key: s4_..." \
  -H "x-maskura-secret-key: s4s_..." \
  --data '{"key_id":"s4_...","public_key_pem":"-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"}'

3. Write and read

A supported text PUT with the processing Content-Type now encrypts detected PII fields server-side:

curl -X PUT https://api.s4.231self.com/my-bucket/contact.txt \
  -H "x-maskura-access-key: s4_..." \
  -H "x-maskura-secret-key: s4s_..." \
  -H "Content-Type: text/plain" \
  --data-binary 'email=alice@example.com&card=4111111111111111'

The stored object contains [REDACTED_EMAIL] text replaced by JSON envelopes. Only someone holding the private key can recover the original values.

Decrypt

Use the Encryption Lab in the dashboard: paste the envelope and your private key PEM to recover plaintext. Or decrypt with OpenSSL / a small script:

# unwrap the data key, then AES-GCM decrypt the field
# (the dashboard does this for you — no need to script it)

Try it now

Open the dashboard → Encryption Lab: paste a key + secret, typeemail=alice@example.com&card=4111111111111111¬e=hi, clickWrite through pipeline, and you'll see the envelope-encrypted output. Paste it (plus your private key) into the Decrypt box to get your plaintext back.

SDK access

The Python and TypeScript SDKs ship a high-level client that does keypair generation, public-key attachment, and client-side decryption for you. Ask in the docs/README for the current SDK snippet.

Security notes

• Maskura never stores or sees your private key.
• Each field gets a fresh random data key (envelope re-encrypted per write).
• Encryption happens before the object is written to your storage backend.
• Revoking the API key does not decrypt stored envelopes — keep your private keys backed up.