Encryption v2

Authenticated encryption protects text or binary content and allows a compatible recipient to detect changes to the encrypted data.

The Encryption Node protects Workflow content using a shared key, password, ChaCha20-Poly1305, or an RSA public certificate. It returns a Flowgear envelope for storage or transfer.

Revision History

0.0.2.0 - Added binary stream, password-based, and ChaCha20-Poly1305 encryption.
0.0.0.4 - Initial release.

Connection

Use an Encryption Key Connection. Populate the credentials required by the selected Method.

Property Type Description
Key Masked Canonical Base64 for exactly 32 cryptographically random bytes; used by AES-256-GCM and ChaCha20-Poly1305.
Password Masked Password used by password-based encryption. This is separate from any certificate import password.
Public Certificate Certificate RSA public certificate used for certificate encryption. The RSA key must be at least 2048 bits.
Private Certificate Certificate Matching RSA certificate with its private key, used for certificate decryption. The RSA key must be at least 2048 bits.

Setup Notes

  • For shared-key encryption, store a securely generated 32-byte random key as canonical Base64 in Key.
  • For password encryption, populate Password. For certificate encryption, select an RSA public certificate.
  • Use a separate, restricted Connection for the private certificate needed for decryption.
  • Keep the original key or private certificate available while its ciphertext is still in use. Replacing Connection credentials does not re-encrypt existing data.

Methods

Text methods preserve exact UTF-8 content. Stream methods preserve binary bytes and return a stream positioned at the beginning.

Encrypt

Encrypts using AES-256-GCM and a fresh random nonce. Produces an fgenc.1 envelope.

Parameter Type Description
Connection Connection Encryption Key Connection containing Key.
Plaintext String Exact text to encrypt, up to 16 MiB after UTF-8 encoding.
Return Type Description
Ciphertext String Authenticated Flowgear envelope containing the encrypted text.

Encrypt Stream

Encrypts using AES-256-GCM and a fresh random nonce. Produces an fgenc.1 envelope. Accepts binary content.

Parameter Type Description
Connection Connection Encryption Key Connection containing Key.
Stream Stream Readable binary input, up to 16 MiB. Seekable streams are read from the beginning.
Return Type Description
Encrypted Stream Stream Authenticated Flowgear envelope as a stream positioned at the beginning.

Encrypt with Certificate

Encrypts with a fresh AES-256-GCM content key wrapped by RSA-OAEP-SHA256. Produces an fgcert.1 envelope.

Parameter Type Description
Connection Connection Encryption Key Connection containing Public Certificate.
Plaintext String Exact text to encrypt, up to 16 MiB after UTF-8 encoding.
Return Type Description
Ciphertext String Authenticated Flowgear envelope containing the encrypted text.

Encrypt Stream with Certificate

Encrypts with a fresh AES-256-GCM content key wrapped by RSA-OAEP-SHA256. Produces an fgcert.1 envelope. Accepts binary content.

Parameter Type Description
Connection Connection Encryption Key Connection containing Public Certificate.
Stream Stream Readable binary input, up to 16 MiB. Seekable streams are read from the beginning.
Return Type Description
Encrypted Stream Stream Authenticated Flowgear envelope as a stream positioned at the beginning.

Encrypt with Password

Derives a key using PBKDF2-HMAC-SHA256 with 600,000 iterations and a fresh 16-byte salt, then encrypts with AES-256-GCM. Produces an fgpwd.1 envelope.

Parameter Type Description
Connection Connection Encryption Key Connection containing Password.
Plaintext String Exact text to encrypt, up to 16 MiB after UTF-8 encoding.
Return Type Description
Ciphertext String Authenticated Flowgear envelope containing the encrypted text.

Encrypt Stream with Password

Derives a key using PBKDF2-HMAC-SHA256 with 600,000 iterations and a fresh 16-byte salt, then encrypts with AES-256-GCM. Produces an fgpwd.1 envelope. Accepts binary content.

Parameter Type Description
Connection Connection Encryption Key Connection containing Password.
Stream Stream Readable binary input, up to 16 MiB. Seekable streams are read from the beginning.
Return Type Description
Encrypted Stream Stream Authenticated Flowgear envelope as a stream positioned at the beginning.

Encrypt with ChaCha20-Poly1305

Encrypts using ChaCha20-Poly1305 and a fresh random nonce. Produces an fgchacha.1 envelope.

Parameter Type Description
Connection Connection Encryption Key Connection containing Key.
Plaintext String Exact text to encrypt, up to 16 MiB after UTF-8 encoding.
Return Type Description
Ciphertext String Authenticated Flowgear envelope containing the encrypted text.

Encrypt Stream with ChaCha20-Poly1305

Encrypts using ChaCha20-Poly1305 and a fresh random nonce. Produces an fgchacha.1 envelope. Accepts binary content.

Parameter Type Description
Connection Connection Encryption Key Connection containing Key.
Stream Stream Readable binary input, up to 16 MiB. Seekable streams are read from the beginning.
Return Type Description
Encrypted Stream Stream Authenticated Flowgear envelope as a stream positioned at the beginning.

Usage Notes

  • Fresh random values mean encrypting the same content twice produces different ciphertext.
  • Use the Decryption Node for text produced by Encrypt or Encrypt with Certificate.
  • Retain the complete envelope unchanged; it includes the information required to authenticate and decrypt the content.
  • Certificate validation checks RSA key material and minimum key strength. Certificate trust, expiry, revocation, and intended usage remain your deployment policy.
  • Keep plaintext and private credentials out of Workflow logs and untrusted downstream Steps.

Known Issues

  • Password and ChaCha20-Poly1305 encryption currently have no matching Decryption methods.
  • No stream-decryption methods are exposed. Stream encryption is a bounded one-shot operation, not unbounded file streaming.
  • Envelopes are Flowgear-specific. They are not JWE, CMS/PKCS#7, OpenPGP, age, or OpenSSL formats.