Encrypting Values

const PBKDF2_ITERATIONS = 200000
const HASH = 'SHA-256'
const AES_LENGTH = 256
const IV_LENGTH = 12
const SALT_LENGTH = 16
const SALT_NAMESPACE = 'envless:workspace:'
const CIPHERTEXT_VERSION_PREFIX = 'v1:'

const encoder = new TextEncoder()

const toBase64 = (bytes: Uint8Array): string =>
    Buffer.from(bytes).toString('base64')

async function workspaceSalt(workspaceUniqueId: string): Promise<Uint8Array> {
    const digest = await crypto.subtle.digest(
        HASH,
        encoder.encode(`${SALT_NAMESPACE}${workspaceUniqueId}`)
    )
    return new Uint8Array(digest).slice(0, SALT_LENGTH)
}

async function deriveKey(passphrase: string, salt: Uint8Array): Promise<CryptoKey> {
    const baseKey = await crypto.subtle.importKey(
        'raw',
        encoder.encode(passphrase),
        { name: 'PBKDF2' },
        false,
        ['deriveKey']
    )

    return crypto.subtle.deriveKey(
        { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: HASH },
        baseKey,
        { name: 'AES-GCM', length: AES_LENGTH },
        true,
        ['encrypt', 'decrypt']
    )
}

export async function encrypt(plaintext: string, passphrase: string, workspaceUniqueId: string): Promise<string> {
    const salt = await workspaceSalt(workspaceUniqueId)
    const key = await deriveKey(passphrase, salt)

    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH))
    const ciphertext = new Uint8Array(
        await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, encoder.encode(plaintext))
    )

    const combined = new Uint8Array(iv.length + ciphertext.length)
    combined.set(iv, 0)
    combined.set(ciphertext, iv.length)

    return `${CIPHERTEXT_VERSION_PREFIX}${toBase64(combined)}`
}

const PBKDF2_ITERATIONS = 200000
const HASH = 'SHA-256'
const AES_LENGTH = 256
const IV_LENGTH = 12
const SALT_LENGTH = 16
const SALT_NAMESPACE = 'envless:workspace:'
const CIPHERTEXT_VERSION_PREFIX = 'v1:'

const encoder = new TextEncoder()

const toBase64 = (bytes) =>
    Buffer.from(bytes).toString('base64')

async function workspaceSalt(workspaceUniqueId) {
    const digest = await crypto.subtle.digest(
        HASH,
        encoder.encode(`${SALT_NAMESPACE}${workspaceUniqueId}`)
    )
    return new Uint8Array(digest).slice(0, SALT_LENGTH)
}

async function deriveKey(passphrase, salt) {
    const baseKey = await crypto.subtle.importKey(
        'raw',
        encoder.encode(passphrase),
        { name: 'PBKDF2' },
        false,
        ['deriveKey']
    )

    return crypto.subtle.deriveKey(
        { name: 'PBKDF2', salt, iterations: PBKDF2_ITERATIONS, hash: HASH },
        baseKey,
        { name: 'AES-GCM', length: AES_LENGTH },
        true,
        ['encrypt', 'decrypt']
    )
}

export async function encrypt(plaintext, passphrase, workspaceUniqueId) {
    const salt = await workspaceSalt(workspaceUniqueId)
    const key = await deriveKey(passphrase, salt)

    const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH))
    const ciphertext = new Uint8Array(
        await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, encoder.encode(plaintext))
    )

    const combined = new Uint8Array(iv.length + ciphertext.length)
    combined.set(iv, 0)
    combined.set(ciphertext, iv.length)

    return `${CIPHERTEXT_VERSION_PREFIX}${toBase64(combined)}`
}

pip install cryptography

import base64, hashlib, os
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

PBKDF2_ITERATIONS = 200000
SALT_NAMESPACE = "envless:workspace:"
SALT_LENGTH = 16
IV_LENGTH = 12
VERSION = "v1:"

def workspace_salt(workspace_unique_id: str) -> bytes:
    digest = hashlib.sha256(f"{SALT_NAMESPACE}{workspace_unique_id}".encode()).digest()
    return digest[:SALT_LENGTH]

def derive_key(passphrase: str, salt: bytes) -> bytes:
    kdf = PBKDF2HMAC(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        iterations=PBKDF2_ITERATIONS,
    )
    return kdf.derive(passphrase.encode())

def encrypt(plaintext: str, passphrase: str, workspace_unique_id: str) -> str:
    key = derive_key(passphrase, workspace_salt(workspace_unique_id))
    iv = os.urandom(IV_LENGTH)
    ciphertext = AESGCM(key).encrypt(iv, plaintext.encode(), None)
    return VERSION + base64.b64encode(iv + ciphertext).decode()

package envless

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "crypto/sha256"
    "encoding/base64"

    "golang.org/x/crypto/pbkdf2"
)

const (
    PBKDF2Iterations = 200000
    SaltNamespace    = "envless:workspace:"
    SaltLength       = 16
    IVLength         = 12
    Version          = "v1:"
)

func workspaceSalt(workspaceUniqueID string) []byte {
    sum := sha256.Sum256([]byte(SaltNamespace + workspaceUniqueID))
    return sum[:SaltLength]
}

func deriveKey(passphrase string, salt []byte) []byte {
    return pbkdf2.Key([]byte(passphrase), salt, PBKDF2Iterations, 32, sha256.New)
}

func Encrypt(plaintext, passphrase, workspaceUniqueID string) (string, error) {
    key := deriveKey(passphrase, workspaceSalt(workspaceUniqueID))

    block, err := aes.NewCipher(key)
    if err != nil {
        return "", err
    }
    aead, err := cipher.NewGCM(block)
    if err != nil {
        return "", err
    }

    iv := make([]byte, IVLength)
    if _, err := rand.Read(iv); err != nil {
        return "", err
    }

    ct := aead.Seal(nil, iv, []byte(plaintext), nil)
    combined := append(iv, ct...)
    return Version + base64.StdEncoding.EncodeToString(combined), nil
}

go get golang.org/x/crypto/pbkdf2

[dependencies]
aes-gcm = "0.10"
pbkdf2 = { version = "0.12", features = ["simple"] }
sha2 = "0.10"
base64 = "0.22"
rand = "0.8"

use aes_gcm::{aead::{Aead, KeyInit, OsRng, generic_array::GenericArray}, Aes256Gcm};
use base64::{engine::general_purpose, Engine as _};
use pbkdf2::pbkdf2_hmac;
use rand::RngCore;
use sha2::{Digest, Sha256};

const PBKDF2_ITERATIONS: u32 = 200000;
const SALT_NAMESPACE: &str = "envless:workspace:";
const SALT_LENGTH: usize = 16;
const IV_LENGTH: usize = 12;
const VERSION: &str = "v1:";

fn workspace_salt(workspace_unique_id: &str) -> Vec<u8> {
    let mut hasher = Sha256::new();
    hasher.update(format!("{}{}", SALT_NAMESPACE, workspace_unique_id).as_bytes());
    hasher.finalize()[..SALT_LENGTH].to_vec()
}

fn derive_key(passphrase: &str, salt: &[u8]) -> [u8; 32] {
    let mut key = [0u8; 32];
    pbkdf2_hmac::<Sha256>(passphrase.as_bytes(), salt, PBKDF2_ITERATIONS, &mut key);
    key
}

pub fn encrypt(plaintext: &str, passphrase: &str, workspace_unique_id: &str) -> Result<String, Box<dyn std::error::Error>> {
    let salt = workspace_salt(workspace_unique_id);
    let key = derive_key(passphrase, &salt);

    let cipher = Aes256Gcm::new(GenericArray::from_slice(&key));
    let mut iv = [0u8; IV_LENGTH];
    OsRng.fill_bytes(&mut iv);

    let ciphertext = cipher.encrypt(GenericArray::from_slice(&iv), plaintext.as_bytes())?;
    let mut combined = iv.to_vec();
    combined.extend_from_slice(&ciphertext);
    Ok(format!("{}{}", VERSION, general_purpose::STANDARD.encode(combined)))
}

<?php
const PBKDF2_ITERATIONS = 200000;
const SALT_NAMESPACE = 'envless:workspace:';
const SALT_LENGTH = 16;
const IV_LENGTH = 12;
const VERSION = 'v1:';

function workspace_salt(string $workspaceUniqueId): string {
    return substr(hash('sha256', SALT_NAMESPACE . $workspaceUniqueId, true), 0, SALT_LENGTH);
}

function derive_key(string $passphrase, string $salt): string {
    return hash_pbkdf2('sha256', $passphrase, $salt, PBKDF2_ITERATIONS, 32, true);
}

function encrypt(string $plaintext, string $passphrase, string $workspaceUniqueId): string {
    $key = derive_key($passphrase, workspace_salt($workspaceUniqueId));
    $iv  = random_bytes(IV_LENGTH);
    $tag = '';
    $ct  = openssl_encrypt($plaintext, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag);
    return VERSION . base64_encode($iv . $ct . $tag);
}

require 'openssl'

PBKDF2_ITERATIONS = 200000
SALT_NAMESPACE    = 'envless:workspace:'
SALT_LENGTH       = 16
IV_LENGTH         = 12
VERSION           = 'v1:'

def workspace_salt(workspace_unique_id)
  OpenSSL::Digest::SHA256.digest(SALT_NAMESPACE + workspace_unique_id)[0, SALT_LENGTH]
end

def derive_key(passphrase, salt)
  OpenSSL::KDF.pbkdf2_hmac(passphrase, salt: salt, iterations: PBKDF2_ITERATIONS, length: 32, hash: 'SHA256')
end

def encrypt(plaintext, passphrase, workspace_unique_id)
  key    = derive_key(passphrase, workspace_salt(workspace_unique_id))
  iv     = OpenSSL::Random.random_bytes(IV_LENGTH)
  cipher = OpenSSL::Cipher.new('aes-256-gcm').encrypt
  cipher.key = key
  cipher.iv  = iv
  ct  = cipher.update(plaintext) + cipher.final
  tag = cipher.auth_tag
  VERSION + [iv + ct + tag].pack('m0')
end

import javax.crypto.Cipher;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;

public class EnvlessEncrypt {
    private static final int PBKDF2_ITERATIONS = 200000;
    private static final String SALT_NAMESPACE = "envless:workspace:";
    private static final int SALT_LENGTH = 16;
    private static final int IV_LENGTH = 12;
    private static final String VERSION = "v1:";

    private static byte[] workspaceSalt(String workspaceUniqueId) throws Exception {
        byte[] digest = MessageDigest.getInstance("SHA-256")
            .digest((SALT_NAMESPACE + workspaceUniqueId).getBytes(StandardCharsets.UTF_8));
        byte[] salt = new byte[SALT_LENGTH];
        System.arraycopy(digest, 0, salt, 0, SALT_LENGTH);
        return salt;
    }

    private static byte[] deriveKey(String passphrase, byte[] salt) throws Exception {
        PBEKeySpec spec = new PBEKeySpec(passphrase.toCharArray(), salt, PBKDF2_ITERATIONS, 256);
        return SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256").generateSecret(spec).getEncoded();
    }

    public static String encrypt(String plaintext, String passphrase, String workspaceUniqueId) throws Exception {
        byte[] key = deriveKey(passphrase, workspaceSalt(workspaceUniqueId));
        byte[] iv = new byte[IV_LENGTH];
        new SecureRandom().nextBytes(iv);

        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"), new GCMParameterSpec(128, iv));
        byte[] ciphertext = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8));

        byte[] combined = new byte[iv.length + ciphertext.length];
        System.arraycopy(iv, 0, combined, 0, iv.length);
        System.arraycopy(ciphertext, 0, combined, iv.length, ciphertext.length);
        return VERSION + Base64.getEncoder().encodeToString(combined);
    }
}

pip install cryptography

#!/usr/bin/env bash
# usage: ./encrypt.sh <plaintext> <passphrase> <workspace-uuid>
set -euo pipefail

PLAINTEXT="$1"
PASSPHRASE="$2"
WORKSPACE_ID="$3"

# 1. salt = sha256("envless:workspace:" + workspaceId)[:16]
SALT_HEX=$(printf 'envless:workspace:%s' "$WORKSPACE_ID" \
    | openssl dgst -sha256 -binary \
    | head -c 16 \
    | xxd -p -c 32)

# 2. derive 32-byte AES key via PBKDF2 (200k iterations, SHA-256)
KEY_HEX=$(openssl kdf -keylen 32 -kdfopt digest:SHA256 \
                      -kdfopt iter:200000 \
                      -kdfopt hexsalt:"$SALT_HEX" \
                      -kdfopt pass:"$PASSPHRASE" \
                      -binary PBKDF2 \
    | xxd -p -c 64)

# 3. random 12-byte IV, AES-256-GCM seal, concat iv || ciphertext, base64, prepend v1:
KEY_HEX="$KEY_HEX" PLAINTEXT="$PLAINTEXT" python3 - <<'PY'
import base64, os
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

key = bytes.fromhex(os.environ['KEY_HEX'])
iv = os.urandom(12)
ciphertext = AESGCM(key).encrypt(iv, os.environ['PLAINTEXT'].encode(), None)
print('v1:' + base64.b64encode(iv + ciphertext).decode())
PY

$ ./encrypt.sh 'postgres://...' "$ENVLESS_PASSPHRASE" "$WORKSPACE_ID"
v1:5J9k...==