DOCS / CONFIGURATION

Configuration

Config file

enprot reads a TOML config file from .enprot/config.toml in the current directory or any parent:

# .enprot/config.toml
[defaults]
cipher = "aes-256-siv"
pbkdf = "argon2id"

[argon2id]
t = 3           # iterations
m = 65536       # memory (KiB)
p = 1           # parallelism

[cas]
dir = ".cas"    # CAS directory relative to project root

[separators]
left = '// <('   # must be quoted — contains special chars
right = ')>'

[policy]
type = "default" # default, nist, or fips

Crypto policies

Policies gate every crypto operation. They check hash algorithms, PBKDF parameters, and cipher modes against an allowlist.

Policy	Hash	PBKDF	AEAD
`default`	Any	Any	Any
`nist`	SHA-2, SHA-3	PBKDF2, Scrypt	AES-GCM, AES-SIV
`fips`	SHA-2, SHA-3	PBKDF2 only	AES-GCM only

Force FIPS mode with --fips or the ENPROT_FIPS=1 env var. On Linux, FIPS auto-engages from /proc/sys/crypto/fips_enabled.

Environment variables

Variable	Description
`ENPROT_CONFIG`	Path to config file (overrides auto-discovery)
`ENPROT_CAS_DIR`	CAS directory
`ENPROT_FIPS`	Force FIPS mode (1/0)
`RUST_BACKTRACE`	Set to `full` for backtraces

Config validation

enprot validates the config at startup. Invalid values (unknown ciphers, too-weak PBKDF params, etc.) produce a clear error with the offending field and expected range.