skills.rest
joelhooks
joelhooksCOMMUNITY
Explore all skills by this author →
Website𝕏@joelhooksGitHub

envelope-encryption

Encrypts agent records with AES-GCM and wraps DEKs using X25519 public keys via Web Crypto.

22|4|Updated Feb 7, 2026
Search Tags:#encryption#sharing#envelope-encryption#web-crypto#key-rotation#x25519#dek
One-click install
npx skills add https://github.com/joelhooks/atproto-agent-network --skill envelope-encryption
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: envelope-encryption
Source: https://github.com/joelhooks/atproto-agent-network/tree/main/.agents/skills/envelope-encryption
Command: npx skills add https://github.com/joelhooks/atproto-agent-network --skill envelope-encryption

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Envelope encryption patterns to protect agent memories by encrypting each record with a per-record DEK, then encrypting the DEK with the recipient's public key to enable secure sharing without touching content.

Core Features & Use Cases

  • Per-record DEK with envelope encryption to isolate data
  • Efficient key rotation and selective sharing across agents
  • Applies to encrypted memories, secure data exchange, and collaborative workflows

Quick Start

Initialize your agent’s memory system to generate per-record DEKs, encrypt content with AES-GCM, and encrypt the DEK with the recipient’s public key for secure sharing.

Frequently Asked Questions about envelope-encryption

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is envelope encryption and how does it protect agent memories?▼

Envelope encryption protects agent memories by encrypting each record with a unique per-record DEK, then encrypting that DEK with a recipient's public key to isolate data and enable secure sharing without touching content.

How do I implement per-record encryption with Web Crypto for secure data sharing?▼

Implement per-record encryption by generating a DEK for each record, encrypting content with AES-GCM, and wrapping the DEK with the recipient's X25519 public key via Web Crypto to enable secure data exchange across agents.

Can I use X25519 and AES-GCM to rotate encryption keys without decrypting stored data?▼

Yes, envelope encryption enables efficient key rotation. You re-encrypt the per-record DEK with a new recipient's public key using X25519, bypassing the need to decrypt and re-encrypt the underlying AES-GCM encrypted content.

Does envelope encryption work for selective sharing across multiple AI agents?▼

Yes, envelope encryption supports selective sharing across agents. By encrypting the per-record DEK with specific recipient public keys, you can securely share data with targeted agents without exposing content to unauthorized parties.

What is the best way to securely share encrypted records between agents without exposing the DEK?▼

The best way to share encrypted records is envelope encryption. Encrypt the record content with AES-GCM using a per-record DEK, then use public-key based DEK encryption to wrap the DEK for the recipient.

Do I need Web Crypto APIs to perform DEK wrapping and public-key based encryption?▼

Yes, this approach requires the Web Crypto API to execute X25519 key agreement, AES-GCM content encryption, and public-key based DEK wrapping to successfully protect and share agent memories.

Related Skills

Explore More Software Engineering Skills→
apakouapakou

E2EE_KeyGeneration

Generate RSA-OAEP key pairs using the Web Crypto API.

Community
Basic
zilliztechzilliztech
3

chat-memory

Store and retrieve past chatbot conversations across sessions using vector memory.

Official
Advanced
MontaQLabsMontaQLabs
5

vox-communication

Send and receive encrypted messages between AI agents via the Matrix protocol.

Official
Intermediate
0xMerl990xMerl99
1

crypto-expert

Advise on applied cryptography, including TLS, encryption, hashing, and key management.

Community
Advanced