Variable Encryption
To better support collaborative use of API documents, the callosum app supports a straightforward encryption scheme using the AES-GCM-256 standard. As with any security principles, you should evaluate the threat models of your organization to determine if the scheme presented here is appropriate for your risk profile. We will happily accept any feedback (to support@callosum.dev) to better secure this scheme!
| Value | Description |
|---|---|
| Passphrase | user-provided string |
| Salt | random 18 bytes |
| IV | random 12 bytes |
| Key | PBKDF2(passphrase, salt) using 600,000 iterations, and returning a 32-byte key, using SHA256 |
| Ciphertext | AES-256 x GCM, with nonce = IV, and MAC appended |
| Result | "$ag2$v=6a$iv=" + Base64(IV) + "$" Base64(Salt) + "$" + Base64(Ciphertext) |
Example implementations of this method in TypeScript, Python, and Go are posted at https://gist.github.com/pbnjay/5f31d67f5b4041c1769d6ae9850d56bd