Module format 

The on-disk format of an encrypted file.

Bytes 0..22 are frozen forever and are fed to the cipher as associated data, so nothing in the header can be altered without invalidating the tag. Everything from offset 22 onwards is defined by suite, which is what lets a future cipher, a chunked mode or compression arrive without a format version bump and without breaking existing repositories.

offset  len  field
     0   11  magic \x00GITXCRYPT\x00
    11    1  format_version
    12    1  suite
    13    1  flags
    14    8  key_id
    22   16  synthetic IV      <- suite-defined
    38   ..  ciphertext        <- suite-defined

Structs

Header

The parsed header of an encrypted file.

Constants

FLAG_LF_NORMALIZED

Bit 0 of flags: the plaintext was normalised to LF before encryption.

FORMAT_VERSION

The only format version written today.

HEADER_LEN

Length of the frozen header, all of which is authenticated.

KEY_ID_LEN

Length of the key fingerprint carried by every file.

MAGIC

Leading bytes identifying our format.

OVERHEAD

Constant number of bytes an encrypted file adds to its plaintext.

SIV_LEN

Length of the synthetic IV produced by AES-SIV.

SUITE_AES_256_SIV

AES-256-SIV (RFC 5297).

Functions

looks_encrypted

Whether content carries our magic.