durable_queue_encryption 0.1.0

Encrypts durable_queue task payloads and error messages at rest with AES-256-GCM. Wraps any storage, including SQLite.

0.1.0

• Initial release.
• EncryptedQueueStorage: wraps any QueueStorage and encrypts each task's payload and last error message and stack trace, with the task id as associated data. Deduplication keys and groups are stored as HMAC-SHA256 tags for lookups and restored on read (protectLookupKeys, on by default).
• AesGcmCipher: AES-256-GCM with a random nonce per write, subkeys derived with HMAC-SHA256, generateKey(), and key rotation through previousKeys.
• PayloadCipher: the interface for other ciphers.
• Tasks stored before encryption are still read (readPlaintext); reencryptAll() encrypts them, or moves every task to a new key.
• PayloadDecryptionException for records that cannot be decrypted, and unreadableTaskIds() to find them after a key is lost.
• Tested with the shared storage contract over memory and SQLite storage, and against data encrypted by an independent AES-GCM implementation.