Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment.
Start a fresh conversation. Replace the highlighted placeholders.
Use implementing-aes-encryption-for-data-at-rest to implement and validate AES-256-GCM protection for [data/storage target] in [authorized test environment], using [key-management approach] with unique 96-bit nonces and authenticated decryption.
Required inputs
[data/storage target]
[authorized test environment]
[key-management approach]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: implementing-aes-encryption-for-data-at-restdescription: Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment.domain: cybersecuritysubdomain: cryptographytags: - cryptography- encryption- aes- data-at-rest- symmetric-encryptionversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.DS-01- PR.DS-02- PR.DS-10mitre_attack: - T1600- T1573- T1553- T1486
Implementing AES Encryption for Data at Rest
Overview
AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) used to protect classified and sensitive data. This skill covers implementing AES-256 encryption in GCM mode for encrypting files and data stores at rest, including proper key derivation, IV/nonce management, and authenticated encryption.
When to Use
When deploying or configuring implementing aes encryption for data at rest capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Implement AES-256-GCM encryption and decryption for files
Derive encryption keys from passwords using PBKDF2 and Argon2
Manage initialization vectors (IVs) and nonces securely
Encrypt and decrypt entire directory trees
Implement authenticated encryption to detect tampering
Handle large files with streaming encryption
Key Concepts
AES Modes of Operation
Mode
Authentication
Parallelizable
Use Case
GCM
Yes (AEAD)
Yes
Network data, file encryption
CBC
No
Decrypt only
Legacy systems, disk encryption
CTR
No
Yes
Streaming encryption
CCM
Yes (AEAD)
No
IoT, constrained environments
Key Derivation
Never use raw passwords as encryption keys. Always derive keys using:
PBKDF2: NIST-approved, widely supported (minimum 600,000 iterations as of 2024)
Argon2id: Winner of Password Hashing Competition, memory-hard
scrypt: Memory-hard, good alternative to Argon2
Nonce/IV Management
GCM requires a 96-bit (12-byte) nonce that must NEVER be reused with the same key
Generate nonces using os.urandom() (CSPRNG)
Store nonce alongside ciphertext (it is not secret)
Workflow
Install the cryptography library: pip install cryptography
Generate or derive an encryption key
Create a random nonce for each encryption operation
Encrypt data using AES-256-GCM with the key and nonce
Store nonce + ciphertext + authentication tag together
For decryption, extract nonce, verify tag, and decrypt