credential_crypto library

Credential-at-rest encryption for the file-backed CLI.

Wraps the credentials JSON in an AES-256-GCM envelope keyed by a wrapping secret (env-supplied or a static obfuscation constant). This is not part of the Filen wire protocol — it only protects the local credentials file, so the format is our own and self-describing:

hex( salt(16) | iv(12) | ciphertext | tag(16) )

The 32-byte AES key is PBKDF2-HMAC-SHA256(secret, salt, 100k). Kept on pointycastle (tiny one-shot payload, no hot path) so it has no FFI/async dependency and works identically everywhere.

Functions

decryptTextWithKey(String hexEnvelope, String secret) → String

Decrypts a hex envelope produced by encryptTextWithKey. Throws on a wrong key or tampered ciphertext (GCM auth failure).

encryptTextWithKey(String text, String secret) → String

Encrypts text under secret, returning a hex envelope.