Encrypt values on the way into any KeyValueStorage. Keys stay in the
clear (they are addresses, not content); values become encrypted envelopes.
A value that is not an envelope is returned as-is, so an existing plaintext
store can be wrapped and migrated on the next write of each entry.
PBKDF2 is the expensive part, so each instance writes under a single salt
and caches the derived key per salt; a burst of autosaves costs one
derivation, and values written by another instance (another salt) are
derived once each on first read.
Encrypt values on the way into any KeyValueStorage. Keys stay in the clear (they are addresses, not content); values become encrypted envelopes. A value that is not an envelope is returned as-is, so an existing plaintext store can be wrapped and migrated on the next write of each entry.
PBKDF2 is the expensive part, so each instance writes under a single salt and caches the derived key per salt; a burst of autosaves costs one derivation, and values written by another instance (another salt) are derived once each on first read.