4723716e08
- Random with constant-time-equal helper - KEK loader from env (Tier 1) with InvalidKekError on bad/missing var - AEAD via direct LibCrypto FFI bindings (Crystal 1.20 stdlib OpenSSL::Cipher doesn't expose GCM auth_data/auth_tag, so we extend LibCrypto with EVP_CIPHER_CTX_ctrl + EVP_aes_256_gcm and call them directly) - Envelope: per-row DEK wrapped by KEK, AAD-bound, algorithm_id reserved for crypto agility (0x01 = AES-256-GCM today, 0x02/0x03 reserved) - 17 unit specs including a 100-iteration random property test - Tag-tampered ciphertext / wrong-AAD / wrong-key all raise Aead::Error |
||
|---|---|---|
| .. | ||
| api-security-scanner | ||
| binary-analysis-tool | ||
| credential-enumeration | ||
| credential-rotation-enforcer | ||
| dlp-scanner | ||
| docker-security-audit | ||
| sbom-generator-vulnerability-matcher | ||
| secrets-scanner | ||
| siem-dashboard | ||