Module backupcrypt 

Encryption of backup files (teamcraft backup --encrypt).

The key is derived from a passphrase with Argon2id (salt and cost in the manifest). Every file – the database dump and each vault object – is encrypted on its own with XChaCha20-Poly1305 in the STREAM construction (64 KiB chunks, each authenticated, the last one marked), so a file is never held in memory, truncation and reordering are detected, and a wrong passphrase or tampering fails before anything is restored:

"TCENC001" | 19-byte random nonce | chunk₁ … chunkₙ (≤ 64 KiB + 16-byte tag each)

The SHA-256 of the plain content is computed on the way in and out, so the manifest and the object names keep naming the plain content.

Structs

BackupKey

A derived backup key with the parameters it came from.

Functions

decrypt

Decrypts sealed into out (any authentication failure, truncation or extra data is an error); returns the SHA-256 of the plain content.

decrypt_file

Decrypts the file source into out; returns the plain SHA-256.

encrypt

Encrypts everything plain yields into out; returns the SHA-256 of the plain content and its length.

encrypt_file

Encrypts the file source into the new file target.