About

Imported from mukul975/anthropic-cybersecurity-skills (skills/implementing-aes-encryption-for-data-at-rest/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill implementing-aes-encryption-for-data-at-rest. Copyright stays with the author (Apache-2.0).

Implementing AES Encryption for Data at Rest

Name: implementing-aes-encryption-for-data-at-rest
Author: mukul975

Overview

AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers implementing AES-256 encryption in GCM mode for encrypting files and data stores at rest, including proper key derivation, IV/nonce management, and authenticated encryption.

When to Use

When deploying or configuring implementing aes encryption for data at rest capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Implement AES-256-GCM encryption and decryption for files
Derive encryption keys from passwords using PBKDF2 and Argon2
Manage initialization vectors (IVs) and nonces securely
Encrypt and decrypt entire directory trees
Implement authenticated encryption to detect tampering
Handle large files with streaming encryption

Key Concepts

AES Modes of Operation

Mode	Authentication	Parallelizable	Use Case
GCM	Yes (AEAD)	Yes	Network data, file encryption
CBC	No	Decrypt only	Legacy systems, disk encryption
CTR	No	Yes	Streaming encryption
CCM	Yes (AEAD)	No	IoT, constrained environments

Key Derivation

Never use raw passwords as encryption keys. Always derive keys using:

PBKDF2: NIST-approved, widely supported (minimum 600,000 iterations as of 2024)
Argon2id: Winner of Password Hashing Competition, memory-hard
scrypt: Memory-hard, good alternative to Argon2

Nonce/IV Management

GCM requires a 96-bit (12-byte) nonce that must NEVER be reused with the same key
Generate nonces using os.urandom() (CSPRNG)
Store nonce alongside ciphertext (it is not secret)

Workflow

Install the cryptography library: pip install cryptography
Generate or derive an encryption key
Create a random nonce for each encryption operation
Encrypt data using AES-256-GCM with the key and nonce
Store nonce + ciphertext + authentication tag together
For decryption, extract nonce, verify tag, and decrypt

Encrypted File Format

[salt: 16 bytes][nonce: 12 bytes][ciphertext: variable][tag: 16 bytes]

Security Considerations

Always use authenticated encryption (GCM, CCM) to prevent tampering
Never reuse a nonce with the same key (catastrophic in GCM)
Use at least 256-bit keys for long-term data protection
Securely wipe keys from memory after use when possible
Rotate encryption keys periodically per organizational policy
For disk-level encryption, consider XTS mode (AES-XTS)

Validation Criteria

AES-256-GCM encryption produces valid ciphertext
Decryption recovers original plaintext exactly
Authentication tag detects any ciphertext modification
Key derivation uses sufficient iterations/parameters
Nonces are never reused for the same key
Large files (>1GB) can be processed via streaming
Encrypted file format includes all necessary metadata

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-aes-3d2cbb/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-implementing-aes-3d2cbb.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-implementing-aes-3d2cbb",
  "kind": "skill",
  "name": "implementing-aes-encryption-for-data-at-rest",
  "description": "Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "legal"
    ],
    "tags": [
      "skill-md",
      "cryptography",
      "encryption",
      "aes",
      "data-at-rest",
      "symmetric-encryption",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/implementing-aes-encryption-for-data-at-rest/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/implementing-aes-encryption-for-data-at-rest/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Implementing AES Encryption for Data at Rest\n\n## Overview\n\nAES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers implementing AES-256 encryption in GCM mode for encrypting files and data stores at rest, including proper key derivation, IV/nonce management, and authenticated encryption.\n\n\n## When to Use\n\n- When deploying or configuring implementing aes encryption for data at rest capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- Wh",
  "cost": {
    "context_tokens": 883
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-aes-3d2cbb/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.