/technology/modules/ · secrets Shipping
secrets
Envelope encryption over the Database port, in two tiers. A database dump is ciphertext plus a blob nobody outside the KMS can open.
What it is
secrets.
Two tiers over the same port. A tenant's secrets live inside that tenant's own database, beside its migration history and its audit chain, which is what makes backup, restore and offboarding one-database operations. The other tier holds the platform's own secrets — never a tenant's — in the control database. Each store holds its own wrapped data key, which the KMS unwraps and never stores, so what a database dump contains is ciphertext plus a blob nobody outside the KMS can open.
A copied row fails to decrypt rather than quietly succeeding. Every ciphertext is bound by the AEAD's additional data to its store, its name, its version and its key id, so a row that is copied into another tenant, renamed, rolled back or repointed at a different key does not open. SecretBytes zeroises on drop, prints as [redacted], and implements neither Display, Serialize nor Clone.
Crate
cratefield-secrets · 0.1.1, MIT
Ports
Database · Clock
Also
A tamper-evident audit chain over every read and write, and key rotation that re-wraps without re-encrypting every row.
The unwrapping half is the KMS port.