Spec for at-rest encryption.

SecurityImpact

Change-Id: I9adcd8979af8f1d0ebd912c503ae36a8041ed32d