Module encryption 

Cryptographic operations for promocrypt-core.

Implements the two-key encryption system using:

• Argon2id for key derivation
• AES-256-GCM for authenticated encryption
• AES-256-SIV for deterministic storage encryption

Constants

ARGON2_MEMORY_COST

Argon2 memory cost in KiB (64 MB)

ARGON2_PARALLELISM

Argon2 parallelism

ARGON2_TIME_COST

Argon2 time cost (iterations)

ENCRYPTED_KEY_SIZE

Encrypted key size (32 bytes key + 16 bytes tag)

NONCE_SIZE

Nonce size for AES-256-GCM

SALT_SIZE

Salt size in bytes

TAG_SIZE

Tag size for AES-256-GCM

Functions

decrypt

Decrypt data with AES-256-GCM.

decrypt_code_from_storage

Decrypt a code from database storage.

decrypt_codes_from_storage

Decrypt multiple codes from storage (batch operation).

decrypt_data

Decrypt data with a data key.

decrypt_data_key

Decrypt a 32-byte data key from storage.

derive_key

Derive a 32-byte key from a password/secret using Argon2id.

encrypt

Encrypt data with AES-256-GCM.

encrypt_code_for_storage

Encrypt a code for database storage (deterministic).

encrypt_codes_for_storage

Encrypt multiple codes for storage (batch operation).

encrypt_data

Encrypt data with a data key (for config/mutable sections).

encrypt_data_key

Encrypt a 32-byte data key for storage.

generate_nonce

Generate a random 12-byte nonce.

generate_random_key

Generate a random 32-byte key.

generate_salt

Generate a random 16-byte salt.

hash_secret

Hash a secret for storage in history (using SHA256).