Package: replicat
[ ˈrɛplɪkət ]ReplicatConfigurable and lightweight backup utility with deduplication and encryption.CompatibilityPython 3.8 (or newer) running on Linux, MacOS, or Windows.Supported backup destinationslocal pathBackblaze B2Amazon S3any S3-compatible serviceYou can implement and use your own adapter for pretty much any backup destination without
changing the source code of Replicat (more on that later).InstallationIt's available on PyPI, sopipinstallreplicatReasoningFor various reasons, I wasn't entirely happy with any of the similar projects that I've tried.Highlights/goals of Replicat:efficient, concise, easily auditable implementationhigh customisabilityfew external dependencieswell-documented behaviourunified repository layoutAPI that existsThis project borrows a few ideas from those other projects, but not enough to be considered
a copycat.BasicsYou can use Replicat to backup files from your machine to arepository, located on abackendsuch as a local directory or cloud storage (like Backblaze B2). Your files are transfered and
stored in an optionally encrypted and chunked form, and references tochunks(i.e. their hash
digests) are stored insnapshotsalong with file name and metadata. You can create, list,
and delete snapshots, and, of course, restore original files from snapshots.Replicat supports two types of repositories:encrypted(the default) andunencrypted.
You may want to disable encryption if you trust your backend provider and network, for example.Chunks, snapshots, and all other pieces of data insideunencryptedrepositories are stored
unencrypted.In case ofencryptedrepositories, Replicat will use symmetric encryption to encrypt chunks
and snapshots. In order to use encryption, you will need to choose a password and generate the key
associated with that password (Replicat can do it for you). You'll need both the password and the
matching key to unlock the repository, but how or where you're going to store them is up to you.Actually, you can create multiple keys with different passwords and maybe share those with
other people. If you ask Replicat to create a "shared" key, it will copy some of the secrets
from your key to the new key, so that you and the owner of the new key could use deduplication
featurestogether, meaning data uploaded by you could be reused (referenced and decrypted)
by the other person. That other person will also be able to create "shared" keys by copying
secrets that were originally copied to their key from your key, and so on. This creates a web of
trust of sorts. If any of this is not desirable, you can create "independent" keys.Names of files, file timestamps, and other file metadata within snapshots are encrypted using
a secret that never gets copied to other keys. That is, if you create a snapshot, owners of shared
keys will be able to see it, but there will be no available information about it beyond its storage
name and the table of chunk references (still, they might still be able to check whether you have
ever uploaded a specific piece of data - that's what enables shared deduplication).
No data will be accessible if a snapshot was created using an independent key.High-level technical detailsThe key is a JSON object that contains parameters for the KDF, which will be used to derive
user key from the password, and a private encrypted section, which can only be decrypted
by the owner of the key and the matching password (i.e., it's encrypted and decrypted using
the previously derived user key). The encrypted section contains secrets for the cryptographic
primitives that control how the data is split into chunks, visibility of chunks of data, and more.The storage names for chunks and snapshots in unencrypted repositories are simply the hash
digests of their contents. For encrypted repositories, the storage name for the chunk is derived
from the hash digest of its contentsandone of the aforementioned secrets, in order to reduce
the chance of successful "confirmation of file" attacks. The chunk itself is encrypted with
the combination of the hash digest of its contentsandanother one of those secrets, since
the usual convergent encryption is vulnerable to that same "confirmation of file" attack. Note that
that these secrets get copied to shared keys in order to support shared deduplication. Table
of chunk references in a snapshot also gets encrypted in a way that lets owners of shared keys to
decrypt it. This helps Replicat to identify which chunks are still referenced by snapshots and
which can be garbage collected.Extremely cool, colorful, in-depth diagrams that I worked really hard onGlossary:Encrypt(data, key)/Decrypt(data, key)- encrypts/decryptsdatawith the encryption keykeyusing an authenticated encryption algorithm. It's normally used to encrypt/decrypt private
sections in keys, as well as chunks and snapshots.Hash(data)- computes the hash digest ofdatausing a hashing algorithm.
It's used to check integrity of data and to derive encryption keys for chunks and snapshots.Mac(data, key)- computes the message authentication code fordatausing suitablekeyand a MAC algorithm. It's mainly used to verify ownership of chunks.SlowKdf(ikm, salt[, context])/FastKdf(ikm, salt[, context])- calls a "slow"/"fast" key derivation
function to obtain an encryption key fromikmusingsaltand an optionalcontext. As a general rule,
replicat uses "slow" KDF for low-entropy inputs and "fast" KDF for high-entropy inputs. The output length
will match the encryption key length of the chosen encryption algorithm.UserKey- encryption key derived asSlowKdf(Password, UserKdfParams), wherePasswordis the user's password andUserKdfParamsis the salt.UserKeyis used to encrypt sensitive
personal data: private sections in keys and file metadata in snapshots.SharedKey,SharedKdfParams,SharedMacKey,SharedChunkerKey- secrets stored in
the private sections of keys.SharedKeyandSharedKdfParamsare used to derive encryption keys using
"fast" KDF (they will encrypt shared data, like chunks and chunk references).SharedMacKeyis the MAC key.SharedChunkerKeypersonalises content-defined chunking (CDC) to prevent watermarking attacks.GetChunkLocation(name, authentication_tag)/GetSnapshotLocation(name, authentication_tag)- obtains the
location for a chunk/snapshot using its name and the corresponding authentication tag.Upload(data, location)- uploadsdatato the backend to the givenlocation.Download(location)- downloads data from the backend at the givenlocation.Command line interfaceThe installer will create thereplicatcommand (same aspython -m replicat).
There are several available subcommands:init- initialises the repository using the provided settingssnapshot- creates a new snapshot in the repositorylist-snapshots/ls- lists snapshotslist-files/lf- lists files across snapshotsrestore- restores files from snapshotsadd-key- creates a new key for the encrypted repositorydelete- deletes snapshots by their namesclean- performs garbage collectionupload-objects- uploads objects to the backend (a low-level command)download-objects- downloads objects from the backend (a low-level command)list-objects- lists objects at the backend (a low-level command)delete-objects- deletes objects from the backend (a low-level command)⚠️WARNING: commands that read from or upload to the repository can safely be run
concurrently; however, there are presently no guards in place that would make it safe
for you to run destructive actions (delete,clean) concurrently with those actionsunlessyou use independent keys (see the explanation above). I do plan to implement them
soon-ish, but in the meantimeDO NOTuse shared keys (or, naturally, the same key)
tosnapshotandcleanat the same time, for example.As far as the upcoming implementation of such guards, it'll be based on locks. I'm familiar
with the lock-free deduplication strategy (like in Duplicacy), but I don't like it much.There are several command line arguments that are common to all subcommands:-r/--repository- used to specify the type and location of the repository backend
(backup destination). The format is<backend>:<connection string>, where<backend>is
the short name of a Replicat-compatible backend and<connection string>is open to
interpretation by the adapter for the selected backend. Examples:b2:bucket-namefor the B2 backend orlocal:some/local/pathfor the local backend
(or justsome/local/path, since the<backend>:part can be omitted for local
destinations). If the backend requires additional arguments, they will appear in the--helpoutput. Refer to the section on backends for more detailed information.-q/--hide-progress- suppresses progress indication for commands that support it-c/--concurrent- the number of concurrent connections to the backend--cache-directory- specifies the directory to use for cache.--no-cachedisables
cache completely.-v/--verbose- increases the logging verbosity. The default verbosity iswarning,-vmeansinfo,-vvmeansdebug.Encrypted repositories require a key and a matching password for every operation:-K/--key-file- the path to the key file-p/--password- the password in plaintext.However, it's more secure to provide the
password in a file via the-P/--password-fileargument, or as an environment variableREPLICAT_PASSWORD.If the backend requires additional parameters (account name, client secret, some boolean flag, or
literally anything else), you'll also be able to set them via command line arguments or
in the configuration file. Refer toBackendssectionto learn more.If you often use many of these arguments, and their values mostly stay the same between
invocations, you may find it easier to put them in a configuration file instead.
There are three arguments related to that:--profile- load settings from this profile in the configuration file--config- path to the configuration file (check--helpfor the default config location)--ignore-config- ignore the configuration fileNote that values from CLI always take precedence over options from the configuration file.
Specifically, to build the final configuration, Replicat considers command line arguments, environment
variables, the configuration file (either the default oneorthe one supplied via--config),
and global defaults, in that order.Names of configuration file options mostly match the long names of command line arguments
(e.g.,hide-progress = truematches--hide-progress,repository = "s3:bucket"matches-r s3:bucket), but you can always refer to theConfiguration filesectionfor full reference.initexamples# Unencrypted repository 'some:repository'. The --encryption none flag disables encryption$replicatinit-rsome:repository--encryptionnone# Encrypted repository with initial password taken from string.# The new key will be printed to stdout$replicatinit-rsome:repository-p'password string'# Encrypted repository with initial password taken from a file.# The new key will be written to 'path/to/key/file'$replicatinit-rsome:repository-Ppath/to/password/file-opath/to/key/file# Specifies the cipher$replicatinit-rsome:repository-p'...'--encryption.cipher.namechacha20_poly1305# Specifies settings for the cipher and the hash algorithm$replicatinit-rsome:repository\-p'...'\--encryption.cipher.nameaes_gcm\--encryption.cipher.key_bits128\--hashing.namesha2\--hashing.bits256# Specifies the KDF name and parameters (for the key)$replicatinit-rsome:repository\-p'...'\--encryption.kdf.namescrypt\--encryption.kdf.n2097152# Specifies the chunking parameters$replicatinit-rsome:repository\-p'...'\--chunking.min-length128_000\--chunking.max-length2_048_000# Equivalent (dashes in argument names are converted to underscores)$replicatinit-rsome:repository\-p'...'\--chunking.min_length128_000\--chunking.max_length2_048_000The main takeaway here is that you can disable encryption simply by setting--encryption none.
Check theCustom settingssectionfor more.snapshotexamples# Unlocks the repository, uploads provided files in encrypted chunks,# using no more than 10 concurrent connections, creating a snapshot$replicatsnapshot-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\-c10\-n'A note (optional)'image.jpgsome-directoryanother-directoryand/more.text# Uploads one file in chunks using 5 concurrent connections, while restricting# the bandswith to 512 KB per second. Creates a new snapshot without any note$replicatsnapshot-rsome:repository--limit-rate512Kfile.loglist-snapshots/lsexamples# Unlocks the repository and lists all of the snapshots$replicatlist-snapshots-rsome:repository-Ppath/to/password/file-Kpath/to/key/file# Same, but without the table header$replicatls-rsome:repository-Ppath/to/password/file-Kpath/to/key/file--no-header# Lists snapshots with names that match any of the regexes passed via -S/--snapshot-regex# In this example, Replicat will only list snapshots whose names start with '123456'# OR include substring 'abcdef'$replicatls-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\-S'^123456'\-Sabcdef# Lists the snapshots, but instead of the default set of columns, displays just the# snapshot name, the number of files in the snapshot, and the total size of the snapshot# (in that order). Oh, there's also --no-header$replicatls-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\--no-header\--columnsname,file_count,sizelist-files/lfexamples# Unlocks the repository and lists all versions of all the files$replicatlist-files-rsome:repository-Ppath/to/password/file-Kpath/to/key/file# Same, but without the table header$replicatlf-rsome:repository-Ppath/to/password/file-Kpath/to/key/file--no-header# Only lists files with paths that match any of the regexes passed via -F/--file-regex# (in this example, PNGs and text files) IF they are included in snapshots that match# the -S regex(es) (i.e., snapshot names that start with '1234beef')$replicatlf-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\-F'\.t[e]?xt$'\-F'\.png$'\-S'^1234beef'# Lists all versions of all the files, but instead of the default set of columns,# displays the original path of the file first, then the snapshot name, the hash digest# of the file, and the file access time (recorded at the time of the snapshot creation)$replicatlf-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\--columnssnapshot_name,path,digest,atimerestoreexamples# Unlocks the repository and restores the latest versions of all files to target directory,# while limiting the download speed to at most 10 MB per second$replicatrestore-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\--limit-rate10M\target-directory# Unlocks the repository and restores the latest versions of files that match any of the# -F regex(es) from snapshots that match any of the -S regex(es)$replicatrestore-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\-F'\.jpg$'\-F'^/root'\-S'abcdef'\-S'12345'\target-directoryadd-keyexamples# Creates an independent key, which will be printed to stdout$replicatadd-key-Npath/to/file/with/new/password# Unlocks the repository and creates a shared key (i.e. with shared secrets)$replicatadd-key-rsome:repository\-p'your password'\-Kyour/key/file\-n'new password as a string'\---shared# Creates an independent key, which will be written to path/to/new/key/file$replicatadd-key-rsome:repository-n'new password as a string'-opath/to/new/key/file# Creates an independent key with some custom encryption key derivation settings$replicatadd-key-rsome:repository\--encryption.kdf.namescrypt\--encryption.kdf.n4194304# Uses your password to create a new key with the copy of data in your key, but with# different encryption key derivation settings (same as in the previous example).# The new key will be printed to stdout$replicatadd-key-rsome:repository\-Pyour/password/file\-Kyour/key/file\--encryption.kdf.n4_194_304\--cloneThis shows a way to customize the KDF parameters for the key, arguably making the data stored
in your key better protected (to the point of probable overkill with values like this).
Use theCustom settingssectionas reference.deleteexamples# Unlocks the repository and deletes snapshots by name (as returned by ls/list-snapshots).# Chunks that aren't referenced by any other snapshot will be deleted automatically$replicatdelete-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\NAME1NAME2NAME3...# Same, but doesn't ask for confirmation$replicatdelete-rsome:repository\-Ppath/to/password/file\-Kpath/to/key/file\NAME1NAME2NAME3...\--yescleanexamples# Unlocks the repository and deletes all chunks that are not referenced by any snapshot$replicatclean-rsome:repository-Ppath/to/password/file-Kpath/to/key/fileupload-objectsexamples# Uploads local files directly to the repository without any additional processing.# File path -> resulting name:#   '/working/directory/some/file' -> 'some/file'#   '/working/directory/another/file' -> 'another/file'#   '/working/directory/another/directory/another-file' -> 'another/directory/another-file'#   '/absolute/directory/path/with-file' -> 'absolute/directory/path/with-file'#   '/absolute/file' -> 'absolute/file'/working/directory$replicatupload-objects-rsome:repository\some/file\/working/directory/another/directory\/absolute/directory/path\/absolute/file# Uploads local files that do not yet exist in the repository (only checks the file names)$replicatupload-objects-rsome:repository--skip-existingsome/filesome/directory# Same, but additionally limits the upload speed to 2 MiB per second$replicatupload-objects\-rsome:repository\--skip-existing\-L2MiB\some/filesome/directorydownload-objectsexamples# Downloads all objects from the repository directly to the current working directory# without any additional processing$replicatdownload-objects-rsome:repository# Same, but it downloads objects to 'different/directory' instead$replicatdownload-objects-rsome:repositorydifferent/directory# Same, but it skips objects that already exist locally (only checks the file names)$replicatdownload-objects-rsome:repository--skip-existingdifferent/directory# Downloads objects whose paths match any the -O regex(es) (i.e., all objects inside of# 'data' OR 'snapshots' top-level directories in the repository) to the current working# directory, skipping existing objects and limiting the download speed to mere# 1 gigabit per second$replicatdownload-objects-rsome:repository-O'^data/'-O'^snapshots/'-S-L1Gblist-objectsexamples# Lists all objects currently in the repository$replicatlist-objects-rsome:repository# Only lists objects whose paths match any of the regexes passed via -O/--object-regex# (i.e., all objects within 'data' AND 'snapshots' top-level directories in the repository)$replicatlist-objects-rsome:repository-O'^data/'-O'^snapshots/'delete-objectsexamples# Deletes objects by their full paths as returned by list-objects$replicatdelete-objects-rsome:repositoryobject/path/1object/path/2...# Same, but doesn't ask for confirmation$replicatdelete-objects-rsome:repositoryobject/path/1object/path/2...-yCheck versionreplicat--versionConfiguration fileAs mentioned in theCommand line interfacesection, options that
you can put in the configuration file mostly match CLI arguments, with few exceptions.Option nameTypeSupported valuesNotesrepositorystring<backend>:<connection string>concurrentintegerIntegers greater than 0hide‑progressbooleantrue,falsecache‑directorypathRelative or absolute pathno‑cachebooleantrue,falsepasswordstringPassword as a stringCannot be used together withpassword-filepassword‑filepathRelative or absolute pathCannot be used together withpasswordkeystringJSON as a stringCannot be used together withkey-filekey‑filepathRelative or absolute pathCannot be used together withkeylog‑levelstringdebug,info,warning,error,critical,fatalCLI option-vincreaseslogging verbosity starting fromwarning, while this option lets you setlowerlogging verbosity, such aserrorIf the backend requires additional parameters (account id, access key, numeric port, or literally
anything else), Replicat lets you provide them via the configuration file. For example, if you see
a backend-specific argument--some-backend-optionin the--helpoutput, the equivalent
configuration file option will be calledsome-backend-option.Here's an example configuration file (it uses TOML syntax)concurrent=10# Relative paths workcache-directory="~/.cache/directory/for/replicat"[debugging]log-level="info"hide-progress=true[my-local-repo]repository="some/local/path"password="<secret>"key="""{"kdf": { ... },"kdf_params": { "!b": "..." },"private": { "!b": "..." }}"""concurrent=15no-cache=true[some-s3-repo]repository="s3:bucket-name"key-id="..."access-key="..."region="..."Options that you specify at the top of the configuration file are defaults and they will be
inherited by all of the profiles. In the example above there are three profiles
(not including the default one):debugging,my-local-repo,some-s3-repo. You can tell
Replicat which profile to use via the--profileCLI argument.Notice thatsome-s3-repoincludes options that were not listed in the table.key-id,access-key,regionare the aforementioned backend-specific options for the S3 backend.
SeeBackends.BackendsRunreplicatcommands with-r <backend>:<connection string>and additional arguments
that are specific to the selected backend. Those arguments may have defaults and may also
be provided via environment variables or profiles. Usereplicat<command>-r<backend>:<connectionstring>--helpto see them.LocalThe format is-r local:some/local/pathor simply-r some/local/path.B2The format is-r b2:bucket-idor-r b2:bucket-name. This backend uses B2 native API and
requireskey ID (--key-idargument, orB2_KEY_IDenvironment variable, orkey-idoption in a
profile)application key (--application-keyargument, orB2_APPLICATION_KEYenvironment variable, orapplication-keyoption in a profile)Sign into your Backblaze B2 account to generate them. Note that you can use the master application
key or a normal (non-master) application key (which can also be restricted to a single bucket).
Refer toofficial B2 docsfor more
information.S3The format is-r s3:bucket-name. RequiresAWS key ID (--key-idargument, orS3_KEY_IDenvironment variable, or thekey-idoption
in a profile)AWS access key (--access-keyargument, orS3_ACCESS_KEYenvironment variable, oraccess-keyoption in a profile)region (--regionargument, orS3_REGIONenvironment variable, orregionoption in a profile)S3-compatibleThe format is-r s3c:bucket-name. Requireskey ID (--key-idargument, orS3C_KEY_IDenvironment variable, or thekey-idoption
in a profile)access key (--access-keyargument, orS3C_ACCESS_KEYenvironment variable, oraccess-keyoption in a profile)host (--hostargument, orS3C_HOSTenvironment variable, orhostoption in a profile)region (--regionargument, orS3C_REGIONenvironment variable, orregionoption
in a profile)Host mustnotinclude the scheme. The default scheme ishttps, but can be changed via the--schemeargument (or, equivalently, theS3C_SCHEMEenvironment variable orschemeoption
in a profile).You can use S3-compatible backend to connect toB2,
S3, and many other cloud storage providers that offer S3-compatible API.Custom backendsreplicat.backendsis a namespace package, making it possible to add custom backends
without changingreplicatsource code.Suppose your backend of choice is a hypothetical low low cost cloud storage
Proud Cloud (pcfor short). The most barebones implementation of the
Replicat-compatible adapter for thepcbackend will require a directory with
the following structure:$treeproud-cloud/
proud-cloud/
└──replicat└──backends└──pc.pyThe-rargument ofreplicatcommands will take the form of-r pc:<connection string>.
Replicat will use it to locate thepcmodule inside thereplicat.backendspackage,
load thereplicat.backends.pc.Clientclass, and pass the<connection string>to its constructor to create the backend instance. In case there are some additional
parameters that are required to connect to Proud Cloud (account id, secret token, etc.),
you should add them to thereplicat.backends.pc.Clientconstructor as keyword-only arguments.
If present, Replicat will generate the corresponding command line arguments with defaultsandyou'll even be able to use environment variables or profiles to provide them.replicat.backends.pc.Clientmust subclassreplicat.backends.base.Backendand implement all
of the methods marked as abstract. You could use implementations of existingreplicat.backends.base.Backendsubclasses as examples. To make your implementation visible
to Replicat, you'll need to add it to the module search path before invokingreplicat(you could use thePYTHONPATHenvironment
variable for that).Here's an example:# ./proud-cloud/replicat/backends/pc.pyfrom.baseimportBackendclassProudCloud(Backend):def__init__(self,connection_string,*,account_id,secret,port=9_876,legacy=False):print(f'PC args:{connection_string=},{account_id=},{secret=},{port=},{legacy=}')......Client=ProudCloud$PYTHONPATH=proud-cloudreplicatinit-rpc:...--help
usage:replicatinit[-h][-rREPO][-q][-cCONCURRENT][-v][-KKEYFILE][-pPASSWORD|-PPASSWORD_FILE_PATH][--account-idACCOUNT_ID][--secretSECRET][--portPORT][--legacyLEGACY][-oKEY_OUTPUT_FILE]optionalarguments:...

argumentsspecifictotheProudCloudbackend:--account-idACCOUNT_IDorthePROUDCLOUD_ACCOUNT_IDenvironmentvariable--secretSECRETorthePROUDCLOUD_SECRETenvironmentvariable--portPORTorthePROUDCLOUD_PORTenvironmentvariable,ortheconstructordefault9876--legacyLEGACYorthePROUDCLOUD_LEGACYenvironmentvariable,ortheconstructordefaultFalse$PYTHONPATH=proud-cloudPROUDCLOUD_LEGACY=truePROUDCLOUD_SECRET='pr0ud'\replicatinit-rpc:...\--account-id12345\--port9877PCargs:connection_string='...',account_id=12345,secret='pr0ud',port=9877,legacy=True
...If you've created a Replicat-compatible adapter for a backend that Replicat doesn't already
supportandyour implementation doesn't depend on additional third-party libraries
(or at least they are not too heavy and can be moved to extras), consider submitting a PR
to include it in this repository.Custom settingsReplicat's default parameters and selection of cryptographic primitives should work well for
most users but they do allow for some customisation if you know what you are doing.Supported primitives and their parameters:NameUseParameters (with defaults)DescriptionNotesaes_gcmAEADkey_bits(256 [bits]),nonce_bits(96 [bits])AES in GCM modeSupports 128, 192, and 256 bit keyschacha20_poly1305AEADChaCha20‑Poly1305scryptKey derivationn(2 ^ 20),r(8),p(1)Scrypt KDFPreferred for low-entropy inputsblake2bHash, HMAC, key derivationlength(64 [bytes])BLAKE2bBLAKE2b-based "KDF" should only be used for high-entropy inputssha2Hashbits(512 [bits])SHA2Supported digest sizes are 224, 256, 384, and 512 bitssha3Hashbits(512 [bits])SHA3Supported digest sizes are 224, 256, 384, and 512 bitsgclmulchunkerCDCmin_length(128K [bytes]),max_length(5.12M [bytes])Content-defined chunking algorithm based on carry-less multiplication (CLMUL)Encryption algorithm, hash algorithm, chunker, as well as their parameters are set for the entire
repository and so apply to all users of the repository. By default, Replicat uses AES256-GCM
for encryption, Scrypt (nis 2 ^ 20,ris 8,pis 1) as the KDF for the user's encryption
key, BLAKE2b (as hash, "KDF", and HMAC), and GCLMULChunker as the chunker, which produces chunks
between 128K and 5.12M in size with default parameters. KDF for the user's encryption key and
KDF params can vary from key to key, though.Repository settingsRepository-wide settings are stored in the file calledconfigthat gets uploaded to the root
of the repository when you initialise it. Here's the defaultconfig:{"hashing":{"name":"blake2b","length":64},"chunking":{"name":"gclmulchunker","min_length":128000,"max_length":5120000},"encryption":{"cipher":{"name":"aes_gcm","key_bits":256,"nonce_bits":96}}}Coincidentally, this hierarchy is how you're expected to provide your custom repository
settings via CLI -- only in a flat representation.For example, to disable encryption for the repository, you'd pass--encryption noneto
theinitcommand. If instead you wish to reduce AES-GCM key size from the default
256 bits to 128 bits, all you need to do is pass--encryption.cipher.key_bits 128(or, equivalently,--encryption.cipher.key-bits 128) during initialisation.
To change the cipher from the default AES256-GCM to ChaCha20‑Poly1305, you'd use--encryption.cipher.name chacha20_poly1305. Note that when you set thenameattribute
like that, Replicat will load the default parameters for the new algorithm and also check
if your settings are valid. It would be an error to provide any parameters
forchacha20_poly1305, say.Changingconfigafter the repository has already been initialised may render
existing data inaccessible.Key settingsYou may specify the KDF and its params whenever you create a new key, so either viainitor viaadd-key. Similar to repository-wide settings, you'd use a flat hierarchical format
for that. For example, in order to increase the work factor for Scrypt (the default KDF),
you could pass--encryption.kdf.n 2097152(next power of two after 1048576) to the command,
or you could tweak Scrypt'srparameter the same way.It's also possible to change the parameters for the existing key by cloning it via
theadd-keycommand. Simply set the--cloneflag and provide the new KDF settings
as shown in the previous paragraph.SecurityIf you believe you've found a security issue with Replicat, please report it toflwaultah@gmail.com(or DM me on Twitter or Telegram).