mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

3.5 KiB

Raw Blame History

name

description

domain

subdomain

Implementing Envelope Encryption with AWS KMS

Overview

Envelope encryption is a strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a master key (KEK) managed by AWS KMS. This approach allows encrypting large volumes of data locally while keeping the master key secure in a hardware security module (HSM) managed by AWS. This skill covers implementing envelope encryption using AWS KMS GenerateDataKey API.

When to Use

When deploying or configuring implementing envelope encryption with aws kms capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Understand the envelope encryption pattern and its advantages
Generate data encryption keys using AWS KMS GenerateDataKey
Encrypt/decrypt data locally using DEKs
Store encrypted DEK alongside ciphertext
Implement key caching to reduce KMS API calls
Handle key rotation with automatic re-encryption
Implement multi-region encryption for disaster recovery

Key Concepts

Envelope Encryption Flow

Call kms:GenerateDataKey to get plaintext DEK + encrypted DEK
Use plaintext DEK to encrypt data locally (AES-256-GCM)
Store encrypted DEK alongside ciphertext
Discard plaintext DEK from memory
For decryption: call kms:Decrypt on encrypted DEK, then decrypt data

Advantages Over Direct KMS Encryption

Aspect	Direct KMS	Envelope Encryption
Max data size	4 KB	Unlimited
Latency	Network round-trip per operation	Local encryption
Cost	$0.03/10,000 requests	Fewer KMS requests
Offline	Not possible	Yes (with cached DEKs)

KMS Key Types

AWS Managed: AWS creates and manages (aws/s3, aws/ebs)
Customer Managed: You create and manage policies
Custom Key Store: Backed by CloudHSM cluster

Security Considerations

Never store plaintext DEK; only keep encrypted DEK
Use key policies to restrict who can call GenerateDataKey and Decrypt
Enable AWS CloudTrail logging for all KMS API calls
Implement key rotation (automatic annual rotation for CMKs)
Use encryption context for authenticated encryption metadata
Handle KMS throttling with exponential backoff

Validation Criteria

GenerateDataKey returns plaintext and encrypted DEK
Data encrypts correctly with plaintext DEK using AES-256-GCM
Encrypted DEK can be decrypted via KMS Decrypt API
Decrypted DEK recovers the original data
Plaintext DEK is wiped from memory after use
Encryption context is validated during decryption
Key rotation re-encrypts DEKs with new master key

3.5 KiB Raw Blame History