skills.rest
SSiertsema
SSiertsemaCOMMUNITY
Explore all skills by this author →
GitHub

encryption-strategy

Design encryption strategies for data at-rest, in-transit, in-use, and end-to-end.

1|Updated Nov 29, 2025
Search Tags:#compliance#encryption#cryptography#data-protection#security-architecture#key-management
One-click install
npx skills add https://github.com/SSiertsema/claude-code-plugins --skill encryption-strategy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: encryption-strategy
Source: https://github.com/SSiertsema/claude-code-plugins/tree/main/encryption-strategy/skills/encryption-strategy
Command: npx skills add https://github.com/SSiertsema/claude-code-plugins --skill encryption-strategy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill guides the design of comprehensive encryption strategies that protect data at-rest, in-transit, in-use, and end-to-end across systems.

Core Features & Use Cases

  • Standards-only cryptography: avoid custom algorithms; rely on vetted implementations.
  • Defense in depth: combine at-rest, in-transit, and access controls to strengthen security.
  • Key management first-class: envelope encryption with KEKs and HSM/KMS-backed DEKs.
  • Crypto agility: versioned ciphertext envelopes and clear migration paths for algorithm transitions.
  • Regulatory alignment: maps to FIPS 140-3, PCI-DSS, GDPR Art. 32, and HIPAA considerations.
  • Data-state-per-category design: At-rest (envelope encryption), In-transit (TLS 1.3 + mTLS), In-use (memory protections), End-to-end (client-side encryption).
  • TLS configuration guidance: TLS 1.3 minimum, AEAD ciphers, automated certificate rotation, PFS, and mTLS for internal services.

Quick Start

Define a data-protection design that covers at-rest, in-transit, in-use, and end-to-end flows and specify the key management plan.

Frequently Asked Questions about encryption-strategy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I design an encryption strategy for data at-rest, in-transit, and in-use?▼

Designing a comprehensive encryption strategy requires mapping data protections across at-rest, in-transit, in-use, and end-to-end states. It specifies envelope encryption, TLS 1.3 configurations, and memory protections while integrating key management lifecycle plans.

What is envelope encryption and how does key management work for regulated data?▼

Envelope encryption uses a Key Encryption Key (KEK) to encrypt Data Encryption Keys (DEKs), which are backed by HSM or KMS infrastructure. This method provides first-class key management, ensuring secure rotation and regulatory alignment for systems handling regulated data.

How do I configure TLS 1.3 for internal services to ensure compliance?▼

Configuring TLS 1.3 requires setting AEAD ciphers, enabling Perfect Forward Secrecy (PFS), and enforcing mutual TLS (mTLS) for internal services. Automated certificate rotation is also necessary to maintain continuous compliance and crypto agility.

Does this encryption strategy align with FIPS 140-3, PCI-DSS, and GDPR requirements?▼

Yes, the encryption strategy explicitly aligns with FIPS 140-3, PCI-DSS, GDPR Article 32, and HIPAA considerations. It maps regulatory requirements to specific cryptographic standards, key rotation practices, and lifecycle management processes.

Can I use custom cryptographic algorithms for my data protection design?▼

No, you must rely on standards-only cryptography and avoid custom algorithms. The strategy mandates using vetted implementations to ensure crypto agility, clear migration paths, and secure versioned ciphertext envelopes for algorithm transitions.

Related Skills

Explore More Software Engineering Skills→
felixgeelhaarfelixgeelhaar
1

legal-expert

Assess licensing, privacy, and regulatory risks in OSS-enabled software.

Community
Advanced
matt-fell-aimatt-fell-ai
1

citadel

Manage decentralized assets and cold-storage keys with HSM integrations.

Community
Advanced
masermediagroup-stackmasermediagroup-stack
1

implementing-tls

Configure and validate TLS and mutual TLS for service traffic.

Community
Advanced
dtsongdtsong
1

crypto-review

Review cryptographic implementations for algorithm correctness, key management, and side-channel resistance.

Community
Advanced