GantryCD
AES-256
At a glance — AES-256-GCM with a 32-byte key held in the process. The simplest provider; no cloud dependency. You own key storage and rotation.
Configure
| Variable | Required | Notes |
|---|---|---|
GANTRYCD_DATA_ENCRYPTION_PROVIDER | Yes | set to aes-256 |
GANTRYCD_DATA_ENCRYPTION_AES_256_KEY_B64 | Yes | base64 of exactly 32 bytes |
How it behaves
- Writes scheme byte
0x01; the body is[nonce(12)][AES-256-GCM ct+tag]. - The row identifier is bound as the GCM additional data, so a value can’t be moved between rows.
- The boot self-test round-trips a probe (including the AAD check) and aborts on failure.
Operational notes
- No rotation tool yet. Changing the key without re-encrypting existing rows makes them undecryptable. Keep the key safe and stable.