Encryption

Encryption and Licensing: How We Built It for a Shipped Product

The complete story of designing a licensing and backup encryption system for a product shipped to customer sites. Ed25519 digital signatures, dual-envelope AES-256-GCM encryption, SHA-256 key derivation, and the master key trust trade-off.

Four translucent stacked encryption layers showing hardware disk encryption in amber, filesystem volume encryption in blue, database TDE in green, and column-level encryption in purple with S3 bucket and key on the side

Database Encryption: What 'Encrypted at Rest' Actually Means

Filesystem encryption, database TDE, column-level encryption, S3 server-side vs client-side - what each layer actually protects, the gaps between them, and how to choose. Drawn from real customer conversations.

Split golden padlock showing symmetric single key and asymmetric key pair with three glowing icons below representing symmetric encryption asymmetric encryption and hashing on dark navy background

Encryption Demystified: Symmetric, Asymmetric, Hashing Explained

A practitioner’s walkthrough of encryption fundamentals - symmetric, asymmetric, hashing - with real algorithm comparisons, a decision framework, and common mistakes from two decades of building production systems.

BitLocker encryption split key visualization showing user holding golden key connected to shield with lock symbol and Microsoft cloud, illustrating shared control and trust boundaries in disk encryption key management

BitLocker Didn't Fail. Trust Did.

BitLocker encryption didn’t fail—trust boundaries shifted. When recovery keys are escrowed by default, control becomes conditional. Linux LUKS, VeraCrypt alternatives, and key management strategies for conscious trust decisions.