# Cryptography Handling Skill

> Instructions for securely encrypting and decrypting data. Use when this capability is needed.

- Skill: `tomevault-io/cryptography-handling-skill` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/cryptography-handling-skill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/cryptography-handling-skill/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/cryptography-handling-skill

---


# Cryptography Handling Skill

This skill defines how to handle encryption for the `AxKeyStore` before data is sent to GitHub.

## Philosophy
The cloud (GitHub) is untrusted. All data must be encrypted at rest (locally before upload) and in transit (via HTTPS).

## Implementation Details

### Master Password
- The user must provide a master password or passphrase to unlock the keystore.
- **Key Derivation**: Use `Argon2id` or `PBKDF2` to derive a symmetric encryption key from the user's password + salt.

### Encryption Schema
- **Algorithm**: XChaCha20-Poly1305 or AES-256-GCM.
- **Library**: Use the `age` crate (for file encryption) or `ring`/`sodiumoxide` for low-level primitives.
- **Structure**:
  ```json
  {
    "salt": "random_salt_for_kdf",
    "nonce": "random_nonce",
    "ciphertext": "base64_encoded_encrypted_data"
  }
  ```

### Decryption Flow
1. Read the JSON blob from GitHub.
2. Extract `salt`, `nonce`, and `ciphertext`.
3. Prompt user for Master Password.
4. Derive Key using Salt + Password.
5. Decrypt `ciphertext` using Key + Nonce.

## Dependencies
- `argon2` (for KDF)
- `chacha20poly1305` or `aes-gcm` (for encryption)
- `rand` (for generating salt/nonce)

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/basilgregory) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->