Encryption
Relevant source files
The following files were used as context for generating this wiki page:Encryption is a foundational security feature in Cyberpath Sentinel, designed to protect data at rest and ensure its integrity. It is a core component of the system's "Security First" design principle, enabling compliance with regulations like HIPAA, SOC 2, and GDPR. The encryption capabilities are planned to be optional but integral for handling sensitive data, such as Personally Identifiable Information (PII) and cryptographic keys.
The system is designed to support modern, authenticated encryption algorithms like AES-256-GCM and XChaCha20-Poly1305. Beyond confidentiality, Sentinel also plans to use cryptographic digital signatures to provide data integrity and tamper detection, ensuring that data is auditable and trustworthy.
Sources: README.md:31, 41, 100-101, 106, IMPLEMENTATION_PLAN.md:16, 221-222
Architecture and Core Components
The encryption functionality is architecturally centered around a dedicated EncryptionManager component, which is integrated into the main Store manager.
Sources: IMPLEMENTATION_PLAN.md:65, 221
Encryption Manager
The EncryptionManager is the proposed component responsible for all cryptographic operations within Sentinel. It will manage a master key and handle the encryption and decryption of document data and specific fields.
The diagram below shows the proposed structure of the EncryptionManager.
Sources: IMPLEMENTATION_PLAN.md:221-234
The proposed implementation for the EncryptionManager is as follows:
pub struct EncryptionManager {
master_key: SecretKey,
key_derivation: KDF,
}
pub enum EncryptionAlgorithm {
AES256GCM,
ChaCha20Poly1305,
}
impl EncryptionManager {
pub fn new(master_key: &[u8; 32]) -> Self
pub fn encrypt(&self, plaintext: &[u8]) -> io::Result<Vec<u8>>
pub fn decrypt(&self, ciphertext: &[u8]) -> io::Result<Vec<u8>>
pub fn encrypt_field(&self, data: &mut Value, field: &str) -> io::Result<()>
pub fn decrypt_field(&self, data: &mut Value, field: &str) -> io::Result<()>
}
Sources: IMPLEMENTATION_PLAN.md:222-234
Store Integration
Encryption is designed to be an optional feature enabled at the Store level. The StoreConfig struct contains a boolean flag, enable_encryption, which controls whether the EncryptionManager is initialized and used.
pub struct StoreConfig {
// ... other fields
pub enable_encryption: bool, // Default: false
// ... other fields
}
pub struct Store {
// ... other fields
encryption: Option<EncryptionManager>,
// ... other fields
}
Sources: IMPLEMENTATION_PLAN.md:69, 75
The following sequence diagram illustrates the high-level flow of encrypting a document field during an insert operation.
Implementation Roadmap
Encryption is a key part of the project's phased implementation plan, primarily addressed in Phase 4.
| Feature | Phase | Priority | Description |
|---|---|---|---|
| File-level encryption | 1 | - | A planned core feature for initial release. |
| Encryption at rest | 3 | - | Enterprise feature using AES-256 or XChaCha20-Poly1305. |
| Encryption & Security | 4 | P1 | The main phase for implementing robust encryption. |
| AES-256 Encryption | 4 | P1 | Implementation of AES-256-GCM for data at rest. |
| Digital Signatures | 4 | P2 | RSA-2048 signing for tamper detection. |
| Access Control | 4 | - | Includes ACLs for encryption keys. |
Sources: README.md:83, 91, IMPLEMENTATION_PLAN.md:300, 307-314
Phase 4: Encryption & Security
This phase is dedicated to building out the core security features of Sentinel.
- Encryption at Rest: This involves implementing AES-256-GCM encryption for documents, managing per-document encryption keys, and providing a secure master key management and rotation strategy.
- Digital Signatures: To ensure data integrity, the plan includes using RSA-2048 to sign documents. This allows for verification of data authenticity and provides a non-repudiable audit trail.
Sources: IMPLEMENTATION_PLAN.md:307-314
Cryptographic Algorithms and Dependencies
The implementation plan specifies several industry-standard cryptographic libraries to be used for the encryption features. These dependencies are listed in the workspace Cargo.toml file.
| Dependency | Version | Purpose |
|---|---|---|
aes-gcm | 0.10 | AES-256-GCM authenticated encryption. |
chacha20poly1305 | 0.10 | ChaCha20-Poly1305 stream cipher. |
argon2 | 0.5 | Key derivation function (KDF). |
rsa | 0.9 | RSA for digital signatures. |
sha2 | 0.10 | SHA-256 hashing for checksums and integrity checks. |
Sources: IMPLEMENTATION_PLAN.md:237-240, 412-416, Cargo.toml:292-296
This selection of libraries indicates a focus on modern, secure, and performant cryptographic primitives. The use of these dependencies is defined as an encryption feature flag in the project's Cargo.toml.
Sources: IMPLEMENTATION_PLAN.md:424
Use Cases and Compliance
Encryption is critical for several of Sentinel's target use cases and for meeting compliance requirements.
- Encryption Key Management: Sentinel can be used to store encryption keys as files, which are themselves protected by filesystem security and Sentinel's own encryption-at-rest capabilities.
- PII Protection: Personally Identifiable Information can be encrypted at rest to meet data privacy regulations.
- Compliance: Encryption at rest is a key control for compliance frameworks such as:
- HIPAA: Protecting electronic health information.
- SOC 2: Ensuring security controls are in place.
- GDPR: Safeguarding personal data.
Sources: README.md:20, 41, 106, IMPLEMENTATION_PLAN.md:16, 331-334
Conclusion
The encryption system in Cyberpath Sentinel is a planned, cornerstone feature designed to provide robust data confidentiality and integrity. By leveraging a dedicated EncryptionManager, modern cryptographic algorithms like AES-256-GCM, and digital signatures, Sentinel aims to deliver a database solution where security and auditability are not afterthoughts but are built into the core architecture. This focus is essential to its mission of providing a transparent, auditable, and compliance-ready data store for sensitive information.