Authenticated encryption protects text or binary content and allows a compatible recipient to detect changes to the encrypted data.
The Encryption Node protects Workflow content using a shared key, password, ChaCha20-Poly1305, or an RSA public certificate. It returns a Flowgear envelope for storage or transfer.
0.0.2.0 - Added binary stream, password-based, and ChaCha20-Poly1305 encryption.
0.0.0.4 - Initial release.
Use an Encryption Key Connection. Populate the credentials required by the selected Method.
| Property |
Type |
Description |
Key |
Masked |
Canonical Base64 for exactly 32 cryptographically random bytes; used by AES-256-GCM and ChaCha20-Poly1305. |
Password |
Masked |
Password used by password-based encryption. This is separate from any certificate import password. |
Public Certificate |
Certificate |
RSA public certificate used for certificate encryption. The RSA key must be at least 2048 bits. |
Private Certificate |
Certificate |
Matching RSA certificate with its private key, used for certificate decryption. The RSA key must be at least 2048 bits. |
- For shared-key encryption, store a securely generated 32-byte random key as canonical Base64 in
Key.
- For password encryption, populate
Password. For certificate encryption, select an RSA public certificate.
- Use a separate, restricted Connection for the private certificate needed for decryption.
- Keep the original key or private certificate available while its ciphertext is still in use. Replacing Connection credentials does not re-encrypt existing data.
Text methods preserve exact UTF-8 content. Stream methods preserve binary bytes and return a stream positioned at the beginning.
Encrypts using AES-256-GCM and a fresh random nonce. Produces an fgenc.1 envelope.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Key. |
Plaintext |
String |
Exact text to encrypt, up to 16 MiB after UTF-8 encoding. |
| Return |
Type |
Description |
Ciphertext |
String |
Authenticated Flowgear envelope containing the encrypted text. |
Encrypts using AES-256-GCM and a fresh random nonce. Produces an fgenc.1 envelope. Accepts binary content.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Key. |
Stream |
Stream |
Readable binary input, up to 16 MiB. Seekable streams are read from the beginning. |
| Return |
Type |
Description |
Encrypted Stream |
Stream |
Authenticated Flowgear envelope as a stream positioned at the beginning. |
Encrypts with a fresh AES-256-GCM content key wrapped by RSA-OAEP-SHA256. Produces an fgcert.1 envelope.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Public Certificate. |
Plaintext |
String |
Exact text to encrypt, up to 16 MiB after UTF-8 encoding. |
| Return |
Type |
Description |
Ciphertext |
String |
Authenticated Flowgear envelope containing the encrypted text. |
Encrypts with a fresh AES-256-GCM content key wrapped by RSA-OAEP-SHA256. Produces an fgcert.1 envelope. Accepts binary content.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Public Certificate. |
Stream |
Stream |
Readable binary input, up to 16 MiB. Seekable streams are read from the beginning. |
| Return |
Type |
Description |
Encrypted Stream |
Stream |
Authenticated Flowgear envelope as a stream positioned at the beginning. |
Derives a key using PBKDF2-HMAC-SHA256 with 600,000 iterations and a fresh 16-byte salt, then encrypts with AES-256-GCM. Produces an fgpwd.1 envelope.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Password. |
Plaintext |
String |
Exact text to encrypt, up to 16 MiB after UTF-8 encoding. |
| Return |
Type |
Description |
Ciphertext |
String |
Authenticated Flowgear envelope containing the encrypted text. |
Derives a key using PBKDF2-HMAC-SHA256 with 600,000 iterations and a fresh 16-byte salt, then encrypts with AES-256-GCM. Produces an fgpwd.1 envelope. Accepts binary content.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Password. |
Stream |
Stream |
Readable binary input, up to 16 MiB. Seekable streams are read from the beginning. |
| Return |
Type |
Description |
Encrypted Stream |
Stream |
Authenticated Flowgear envelope as a stream positioned at the beginning. |
Encrypts using ChaCha20-Poly1305 and a fresh random nonce. Produces an fgchacha.1 envelope.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Key. |
Plaintext |
String |
Exact text to encrypt, up to 16 MiB after UTF-8 encoding. |
| Return |
Type |
Description |
Ciphertext |
String |
Authenticated Flowgear envelope containing the encrypted text. |
Encrypts using ChaCha20-Poly1305 and a fresh random nonce. Produces an fgchacha.1 envelope. Accepts binary content.
| Parameter |
Type |
Description |
Connection |
Connection |
Encryption Key Connection containing Key. |
Stream |
Stream |
Readable binary input, up to 16 MiB. Seekable streams are read from the beginning. |
| Return |
Type |
Description |
Encrypted Stream |
Stream |
Authenticated Flowgear envelope as a stream positioned at the beginning. |
- Fresh random values mean encrypting the same content twice produces different ciphertext.
- Use the Decryption Node for text produced by
Encrypt or Encrypt with Certificate.
- Retain the complete envelope unchanged; it includes the information required to authenticate and decrypt the content.
- Certificate validation checks RSA key material and minimum key strength. Certificate trust, expiry, revocation, and intended usage remain your deployment policy.
- Keep plaintext and private credentials out of Workflow logs and untrusted downstream Steps.
- Password and ChaCha20-Poly1305 encryption currently have no matching Decryption methods.
- No stream-decryption methods are exposed. Stream encryption is a bounded one-shot operation, not unbounded file streaming.
- Envelopes are Flowgear-specific. They are not JWE, CMS/PKCS#7, OpenPGP, age, or OpenSSL formats.