skills.rest
planetaryescape
planetaryescapeOFFICIAL
Explore all skills by this author →
GitHub

encryption-aes-gcm

Encrypt and decrypt credentials with AES-256-GCM and per-encryption IVs.

7|Updated Dec 4, 2025
Search Tags:#security#encryption#Convex#Node#aes-256-gcm#BYOD#BYOK
One-click install
npx skills add https://github.com/planetaryescape/blah.chat --skill encryption-aes-gcm
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: encryption-aes-gcm
Source: https://github.com/planetaryescape/blah.chat/tree/main/.claude/skills/encryption-aes-gcm
Command: npx skills add https://github.com/planetaryescape/blah.chat --skill encryption-aes-gcm

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides robust encryption for sensitive credentials (BYOD/BYOK) using AES-256-GCM, ensuring per-encryption IVs and authenticated data to prevent leakage and tampering.

Core Features & Use Cases

  • AES-256-GCM encryption/decryption with per-encryption IVs and authentication tags to protect keys and secrets.
  • BYOK pattern supports storing multiple encrypted keys (vercelGateway, openRouter, groq, deepgram) along with IVs and auth tags, enabling secure key management.
  • BYOD pattern manages encrypted deployment credentials (deployment URL and deploy key) with shared IV and authTag storage, simplifying secure configuration retrieval.
  • Real-world use: safeguard API keys and deployment credentials in Convex workflows while enabling secure decryption on demand.

Quick Start

Configure BYOD_ENCRYPTION_KEY in your environment. Use the encryption utilities to encrypt credentials and store the resulting encrypted value, IV, and authTag according to BYOK/BYOD flows. Then decrypt when needed, ensuring authTag verification before use.

Frequently Asked Questions about encryption-aes-gcm

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I encrypt API keys using AES-256-GCM in a Node.js application?▼

AES-256-GCM encryption protects sensitive credentials by generating a unique initialization vector (IV) and an authentication tag per encryption operation. This prevents data leakage and tampering during BYOK or BYOD workflows by verifying the authTag upon decryption.

What environment variables do I need to set up AES-256-GCM credential encryption?▼

AES-256-GCM credential encryption requires setting the BYOD_ENCRYPTION_KEY environment variable before use. This primary secret allows the Node crypto module to securely encrypt and decrypt your BYOK and BYOD configuration values.

Can I use AES-256-GCM to store multiple encrypted API keys for different providers?▼

AES-256-GCM supports storing multiple encrypted API keys for different providers using the BYOK pattern. It securely encrypts multiple keys, such as vercelGateway or deepgram, each with individually associated IVs and authentication tags.

How does authenticated encryption prevent tampering with stored deployment credentials?▼

Authenticated encryption prevents tampering with deployment credentials by generating an authTag during encryption. During decryption, the system verifies this authTag against the encrypted data and IV, ensuring the credentials have not been altered.

Does decrypting BYOD credentials require verifying the authentication tag?▼

Decrypting BYOD credentials requires verifying the authentication tag. Proper Node crypto usage mandates authTag verification during decryption to ensure the encrypted deployment URL and deploy key have not been tampered with before use.

Related Skills

Explore More Software Engineering Skills→
PlazaCCPlazaCC
2

dotenvx

Encrypt .env files and inject decrypted variables into process.env at runtime.

Official
Intermediate
b-open-iob-open-io
14

bitcoin-backup

Encrypt and decrypt private key backups using AES-256-GCM with PBKDF2.

Official
Advanced
PatrityPatrity

secret

Manage encrypted secrets in Cognova's vault via CLI commands.

Community
Intermediate
HabitaNexusHabitaNexus
1

Security Best Practices

Implement multi-layer security for Flutter apps with obfuscation, certificate pinning, and secure storage.

Official
Advanced