13.3 Secrets and field encryption

• secret<T>: Show prints ***; the value does not get into logs and traces; it is serialised only per §9.3; memory is wiped on destruction; reading is s.reveal() (the analyzer makes sure that the result does not leak into a log).
• @encrypted on a table, topic or actor field is envelope encryption with AES-256-GCM: the data key is encrypted with a master key from the coordinator's built-in KMS or an external kms(url) in cluster. Master key rotation is oxl keys rotate.

Implementation-defined. KMS and encryption (D-8055; DIV-027; D-4739, D-4899, D-4999). This implementation: the master key is read from a file (OXL_KMS_KEY_FILE; in the dev profile without it a local key file is created with a warning, in prod it is refused); an external kms(url) is not supported; @encrypted encrypts the whole record, not a single field; data keys are bound to the node; the CA custodian is a single node without failover; the private key of a joining node is stored without wrapping.

Related diagnostics

secret-leak

Source: docs/spec/oxl-standard.en.md