Cipher

Use it from your app

import { ShrouDB } from "@shroudb/sdk";

const db = new ShrouDB({
  moat: process.env.SHROUDB_URL,   // e.g. http://localhost:8200
  token: process.env.SHROUDB_TOKEN,
});
const b64 = (s: string) => Buffer.from(s).toString("base64");

// Encrypt before writing to your own database
const { ciphertext } = await db.cipher.encrypt("customers", b64(ssn), {
  context: customerId,
});
await sql`UPDATE customers SET ssn = ${ciphertext} WHERE id = ${customerId}`;

// Decrypt when you need the value
const { plaintext } = await db.cipher.decrypt("customers", row.ssn, {
  context: customerId,
});

What it does

• Keys are generated and stored inside ShrouDB. Your app only sees ciphertext.
• Keyrings rotate on a schedule you set. Old ciphertext keeps decrypting.
• REWRAP re-encrypts existing ciphertext under the newest key version.
• Optional CONTEXT binds a ciphertext to a record, so it can't be swapped onto another row.
• Convergent mode produces the same ciphertext for the same input, for equality lookups.
• Data keys for encrypting large payloads locally (envelope encryption).
• Signing and signature verification.

Turn it on

Cipher runs inside Moat, the ShrouDB server. Add this to moat.tomland restart. It shares Moat's encrypted storage, access tokens, and audit log with the other engines.

[engines.cipher]
enabled = true

[engines.cipher.keyrings.customers]
algorithm = "aes-256-gcm"
rotation_days = 90

Commands

Over RESP3, prefix each command with CIPHER. Over HTTP, send POST /v1/cipher {"args": [...]}. The SDKs have a method for each.