AshEnvelope

AshEnvelope provides envelope encryption primitives and key grant management for the Ash ecosystem.

It uses AES-256-GCM for encryption with random IVs and authentication tags, and supports multi-recipient key management through a grants table pattern.

Features

• AES-256-GCM encryption/decryption for arbitrary data
• DEK wrapping/unwrapping for envelope encryption schemes
• Key Grants for multi-recipient scenarios (share/revoke access)
• BlobIO KeyManagers (Asymmetric, KeyGrants) for encrypting AshStorage attachments
• Backup-key escrow (opt-in) with a dedicated rotation Mix task and a fail-on-incomplete check
• Reconciliation keeps grants in sync with the encrypted resource's :read policy
• Mix task generators for scaffolding key grants and grant-request infrastructure

Tutorials

• Getting Started with AshEnvelope

Topics

• How Envelope Encryption Works
• Reconciliation
• Expiring Grants
• User-driven fulfillment

Reference

• AshEnvelope API