filecrypt

Encryption of the users' shared files in a remote store.

With store_key set, a user's shared files are encrypted before they leave the node and decrypted as they arrive, each user under a key of their own. That key is random, made the first time the user's files are sent, and kept in the store (cluster/file_keys/<user>.yml) wrapped under the cluster key every node derives from store_key. So the bucket's keys alone read no user's file, the cluster key alone reads none either, and deleting a user's key, which deleting the user does, makes their files unreadable wherever a copy of the bucket is.

A file is MAGIC, a nonce, and the AES-256-GCM ciphertext of its content with MAGIC as the associated data. An object without the header was written before the key was set and is read as it is; it is encrypted when next sent.