DOCS / QUICK START

Quick Start

This guide walks through the core enprot operations in five minutes.

1. Create a document with secrets

// Application configuration
// <( BEGIN database_url )>
postgres://user:pass@db.internal:5432/prod
// <( END database_url )>

max_connections = 100
timeout = 30

2. Encrypt the secret

enprot encrypt -w database_url=mypassword config.txt

The BEGIN/END block is replaced with an ENCRYPTED block:

// Application configuration
// <( ENCRYPTED database_url pbkdf:$argon2id$v=19$m=65536,t=3,p=1$c2FsdA$... cipher:aes-256-siv )>
// <( DATA SGVsbG8gV29ybGQhIFRoaXMgaXMgZW5jcnlwdGVkIGRhdGEu )>
// <( END database_url )>

max_connections = 100
timeout = 30

3. Decrypt it back

enprot decrypt -w database_url=mypassword config.txt

4. Store large blocks in CAS

enprot store -w large_blob=.password config.txt
# Stored blob: sha3-256=a1b2c3d4e5f6...
#   size: 2.4 KB
#   location: .cas/a1b2c3d4e5f6...

Restore with fetch:

enprot fetch -w large_blob=.password config.txt

5. Sign and verify

enprot keygen --alg ed25519 --output priv.pem
# Private key: priv.pem
# Public key fingerprint: abc123def456...

enprot encrypt --signer priv.pem --anchor config.txt
# Signed CHAIN anchor:
#   signer: abc123def456...
#   algorithm: ed25519

enprot verify config.txt
# CHAIN anchor verified

6. Deterministic mode for CAS dedup

enprot encrypt -w SECRET --cipher aes-256-gcm-det config.txt

Identical plaintext always produces identical ciphertext — enabling CAS dedup on encrypted segments.