QUESTIONS & ANSWERS
Frequently asked.
Everything you need to know about Engyon Protected Text and the enprot CLI.
What is Engyon Protected Text?
EPT is a markup syntax that embeds cryptographic confidentiality, integrity, and provenance directly into text files. It works in any language with a comment syntax — C, Rust, Python, Markdown, LaTeX, and more. You encrypt, sign, and store segments of a document without changing how it renders.
What is enprot?
enprot is the reference CLI implementation of EPT. It parses EPT-annotated files and applies four idempotent transformations: encrypt, decrypt, store (to CAS), and fetch (from CAS). It also supports signing, verification, merging, and conflict resolution.
How is this different from git-crypt or SOPS?
git-crypt encrypts entire files. SOPS encrypts specific YAML/JSON keys. Engyon encrypts arbitrary text segments inside any file format — the protection lives inside the document, not in an external wrapper. Engyon also adds signatures, CAS, provenance chains, and merge-friendly segment semantics that git-crypt and SOPS don't offer.
Does it work with Git?
Yes. EPT segments are independent and commute at the block level. Two branches that modify different WORDs merge without conflict. The enprot merge driver resolves conflicts at the WORD/segment level, not the line level. With deterministic AEAD, identical secrets produce identical ciphertext — no spurious merge conflicts.
What cryptographic algorithms are supported?
AEAD: AES-256-SIV (default), AES-256-GCM, AES-256-GCM-SIV. Signatures: Ed25519 (default), ECDSA P-384, RSA 3072, ML-DSA-65 (post-quantum), OpenPGP via librnp. KDF: Argon2id (default), Scrypt, PBKDF2. Hashing: SHA-3-256/512. All via Botan 3.
What are deterministic AEAD variants?
The -det suffix (aes-256-gcm-det) means the nonce is derived from the plaintext via HKDF+HMAC. Same plaintext always produces the same ciphertext. This enables CAS deduplication on encrypted segments — identical secrets across files share the same CAS blob. It also means encrypt(encrypt(x)) = encrypt(x) — idempotent.
What is content-addressed storage (CAS)?
CAS stores data by its hash. Instead of keeping large ciphertext inline in the document, enprot stores it in a CAS directory (default: .cas/) and replaces it with a STORED pointer containing the hash. The document stays compact; blobs are fetched on demand.
Can I use it for classified government documents?
Yes. EPT was designed for multi-level classification. A document can contain Top Secret, Secret, and Unclassified sections. The unclassified version replaces classified blocks with opaque ciphertext references. The same file serves all audiences — recipients without the key see only ciphertext.
What platforms does enprot support?
Linux (x86_64 and ARM64 via musl static binaries), macOS (Intel and Apple Silicon), and Windows (MSVC). Prebuilt binaries are available from GitHub Releases. Build from source with cargo install enprot (requires Botan 3 and librnp).
Is it free and open source?
Yes. enprot is open source under the BSD-2-Clause license, maintained by Ribose Group Inc. The EPT syntax is formally specified in Ribose Standard RSD 12001.
What is the relationship to Confium?
Confium is Ribose's threshold cryptography project. enprot's SignerProvider trait includes an AsyncSignerProvider for async/threshold signing. Once Confium's daemon CLI ships, enprot will support k-of-n threshold signatures (FROST, CMP20) out of the box.
How do I get started?
Install enprot via cargo install enprot, then run enprot encrypt -w SECRET file.txt to encrypt a segment. See the Quick Start guide for a complete walkthrough.
Still have questions?
Open an issue on GitHub or read the full documentation.