Envelope Encryption & AES-256-GCM Architecture
Deep dive into the cryptographic design of Vyntech Secrets Vault: zero-exposure memory handling, authenticated symmetric encryption, versioned Key Encryption Keys (KEKs), and collision-resistant nonce generation.
1. Cryptographic Pipeline Specification
| Parameter | Implementation Standard | Cryptographic Rationale |
|---|---|---|
| Cipher | AES-256-GCM | NIST SP 800-38D authenticated encryption providing confidentiality & integrity. |
| Key Length | 256 bits (32 bytes) | Quantum-resistant symmetric brute-force security boundary. |
| Nonce / IV | 96 bits (12 bytes) | Generated using Go crypto/rand (CSPRNG) per write. |
| Auth Tag | 128 bits (16 bytes) | Verifies ciphertext authenticity before releasing decrypted bytes. |
2. Zero-Downtime KEK Rotation (F-13 Standard)
Traditional vaults require full re-encryption of all database records when rotating keys, causing heavy table locks and downtime. Vyntech Vault solves this with multi-epoch versioned KEK tracking:
Step 1: Admin Triggers Rotation
Calling POST /v1/secrets/keys/rotate generates a new cryptographically random 256-bit key in kek_versions.
Step 2: Instant Primary Switch
New key becomes is_primary = true. All new secrets and updates immediately use the new key version.
Step 3: Seamless Historical Reads
Existing secrets retain their stored kek_version tag and are decrypted seamlessly using the archived key.