Envelope Encryption

Maskura can envelope-encrypt detected fields in supported processed objects. Current gateways use hybrid X25519 + ML-KEM-768 key encapsulation with AES-256-GCM.

What the gateway sees

The selected transform sees plaintext transiently while it runs inside a per-session Wasm sandbox. The encrypted output does not retain that plaintext, and Maskura never receives the client’s private key. Decryption happens on the client.

How a field is protected

1. The gateway creates a fresh 256-bit data-encryption key for the field and encrypts the value with AES-256-GCM.
2. X25519 and ML-KEM-768 shared secrets are combined with HKDF-SHA256 to encapsulate that key to the client’s hybrid public key.
3. The ciphertext, authentication tag, nonce, and encapsulated key material are written to storage.

{"alg":"X25519+ML-KEM-768/AES-256-GCM","iv":"…","enc_dek":"…","ct":"…","tag":"…"}

Set it up

1. Create an API key in the dashboard. Its secret is shown once.
2. Select Set Encryption Key. The browser generates a hybrid keypair locally and sends only the public key to Maskura.
3. Save the MASKURA HYBRID PRIVATE KEY PEM when it is shown. It cannot be retrieved later.
4. Use the Encryption Lab to run a supported write and decrypt its result locally.

New encrypted writes accept only MASKURA HYBRID PUBLIC KEY PEM blocks. RSA public keys are rejected. Without a compatible public key, the envelope filter redacts detected values instead of encrypting them.

The envelope

• iv is the 12-byte AES-GCM nonce.
• enc_dek contains a 32-byte ephemeral X25519 public key followed by the 1088-byte ML-KEM-768 ciphertext.
• ct and tag contain the encrypted field and its authentication tag.

Security properties

• A fresh data key is derived for every encrypted field.
• AES-GCM authenticates the encrypted value and rejects tampering.
• A new envelope remains confidential unless both X25519 and ML-KEM-768 are broken.
• Encryption fails closed: a field is redacted instead of emitted as plaintext if encapsulation fails.
• Legacy RSA-OAEP/AES-256-GCM objects remain readable with older compatible clients; current gateways do not create new ones.