@@ -35,11 +35,11 @@ likely that security bugs get introduced, and the less complexity to maintain an
3535Only where not otherwise possible should low level primitives be used, and this should be done with
3636extreme caution and oversight.
3737
38- Encryption in the TypeScript clients for new cases is deprecated. Any new cryptographic code should be
39- written in the SDK, if possible. Existing use-cases can be continued in the TypeScript clients for
40- now, but eventually will be migrated too. First, the
41- SDK has better memory safety guarantees and prevents key material from being left behind in memory.
42- Second, newer, safer APIs are not exposed outside of the SDK.
38+ Encryption in the TypeScript clients for new cases is deprecated. Any new cryptographic code should
39+ be written in the SDK, if possible. Existing use-cases can be continued in the TypeScript clients
40+ for now, but eventually will be migrated too. First, the SDK has better memory safety guarantees and
41+ prevents key material from being left behind in memory. Second, newer, safer APIs are not exposed
42+ outside of the SDK.
4343
4444## Terminology
4545
@@ -55,8 +55,8 @@ cryptography, not described here.
5555### Content-encryption-keys
5656
5757A content-encryption-key is a per-item key that encrypts a single piece of data. It is created with
58- said data, and re-created (a new, randomly sampled key is created) when the data changes. The purpose is to decouple the
59- data from any upstream keys used to protect or share it.
58+ said data, and re-created (a new, randomly sampled key is created) when the data changes. The
59+ purpose is to decouple the data from any upstream keys used to protect or share it.
6060
6161For instance consider a large file that should be protected. If the account's symmetric key needs to
6262be rotated, and supposing the account symmetric key was used to encrypt the file, then the
@@ -68,12 +68,12 @@ keys").
6868
6969### Key wrap
7070
71- Key wrapping describes encrypting a symmetric key, a signature key or private key with a ** symmetric **
72- key. There are various reasons for doing this. One of them is decoupling of keys, as in the content
73- encryption key example above. Another is implementing sharing mechanisms. When a set of encrypted
74- items needs to be shared, such as a vault item consisting of the content and a set of individually
75- encrypted file attachments, each content-encryption-key can be wrapped so that only a single key
76- needs to be shared instead of sharing a set of keys.
71+ Key wrapping describes encrypting a symmetric key, a signature key or private key with a
72+ ** symmetric ** key. There are various reasons for doing this. One of them is decoupling of keys, as
73+ in the content encryption key example above. Another is implementing sharing mechanisms. When a set
74+ of encrypted items needs to be shared, such as a vault item consisting of the content and a set of
75+ individually encrypted file attachments, each content-encryption-key can be wrapped so that only a
76+ single key needs to be shared instead of sharing a set of keys.
7777
7878## How to use cryptography to build features
7979
0 commit comments