ENGYON PROTECTED TEXT
Confidentiality and provenance
for collaborative text.
Embed encryption, content-addressed storage, and signed chain anchors inside any text file — without breaking the host language. One file, multiple clearance levels, zero external dependencies.
- 5
- AEAD cipher modes
- 3
- Platforms (Linux, macOS, Windows)
- 0
- Runtime dependencies (static)
- 1.88
- MSRV (Rust)
Click the tabs to see how enprot transforms a document →
CAPABILITIES
Everything you need to protect
text at rest.
Nine capabilities covering confidentiality, integrity, provenance, and collaboration — all embedded in the document itself.
Inline AEAD encryption
Encrypt individual sections of any text file with AES-256-SIV, AES-256-GCM, or AES-256-GCM-SIV. Deterministic variants derive nonces from plaintext for CAS dedup.
Content-addressed storage
Large or sensitive blocks are stored by SHA-3-256 hash. Documents stay compact — blobs are fetched on demand from local, S3, or IPFS backends.
Digital signatures
Sign sections with Ed25519, ECDSA P-384, RSA 3072, ML-DSA-65 (post-quantum), or OpenPGP via librnp. Signatures survive classification transitions.
Immutable integrity blocks
Lock content with hash-based protection. Any tampering is detected on verify. Mute blocks to replace content with an opaque hash pointer.
Merge-friendly segments
EPT segments are independent and commute at the block level. Git merges, rebases, and cherry-picks work without conflicts — even across classification levels.
Host-language agnostic
EPT directives live in comments. Works in C, Rust, Python, shell, YAML, Markdown, AsciiDoc, LaTeX, HTML, XML. Zero rendering impact.
Multi-recipient encryption
Encrypt for multiple recipients using ML-KEM (FIPS 203) encapsulation. Each recipient gets their own ciphertext; the document carries all of them.
Provenance chain anchors
Build a signed chain of anchors — each carrying parents, timestamps, and mutation types. Verify the full provenance history of any document.
Capability-ledger model
Track who signed what, when, and with which threshold scheme. Support for Confium threshold signing (FROST, CMP20) — identity-free, key-distribution-free.
USE CASES
Who is it for?
Classified government documents
Mark sections at different clearance levels. Unclassified versions replace classified content with opaque ciphertext — the same file serves both audiences.
Collaborative editing with secrets
Team members at different trust levels edit the same file. Encrypted segments are invisible to those without the key. Git history works normally.
Supply-chain manifest signing
Sign build manifests, SBOMs, and provenance attestations inline. Verifiers check signatures without external tooling — the proof is in the file.
Redactable public documents
Publish a document with classified sections muted (hash pointers). Readers see the structure; content is available only to authorized parties.
COMPARISON
How does Engyon compare?
| Feature | enprot | git-crypt | SOPS | age |
|---|---|---|---|---|
| Encryption lives inside the file | — | — | — | |
| Partial encryption (per-section) | — | — | ||
| Content-addressed storage | — | — | — | |
| Inline digital signatures | — | — | — | |
| Git merge-friendly | — | — | ||
| Post-quantum (ML-DSA, ML-KEM) | — | — | — | |
| OpenPGP support | — | — | ||
| Deterministic encryption (CAS dedup) | — | — | — | |
| Any text format (not just YAML/JSON) | — | — |
QUICK START
Three commands to get going.
# Install enprot
cargo install enprot# Encrypt a segment
enprot encrypt -w SECRET config.rs# Decrypt it back
enprot decrypt -w SECRET config.rs