Skip to content

Function: encryptFieldPq()

encryptFieldPq(provider, aad, value): Promise<PqEnvelope>

Defined in: core/src/schema/crypto-pq.ts:102

Encrypt with a PQ-hybrid provider: derive a KEM shared secret, use it as the AEAD content key, wrap the classic envelope inside { kem, inner }.

keyId still identifies the DEK schedule the AAD is bound to, so an operator can rotate the provider without invalidating older envelopes.

PqHybridProvider

EncryptionAAD

unknown

Promise<PqEnvelope>