Fix secrets docs: encryption uses a per-value nonce, not salt#18523
Fix secrets docs: encryption uses a per-value nonce, not salt#18523
Conversation
The docs described the per-value component of AES-256-GCM encryption as a "salt" when it is actually a "nonce" (number used once). These are distinct cryptographic concepts — a salt is used in key derivation (like PBKDF2), while a nonce is used per-encryption in authenticated encryption modes like GCM. See source: https://github.com/pulumi/pulumi/blob/e8d341245d3d7e42f9f8366c8b057c29cac83a1e/sdk/go/common/resource/config/crypt.go#L157-L158
Docs ReviewScope: Result: No issues found. This is a clean, accurate terminology fix. The change correctly replaces "salt" with "nonce" on line 202. AES-256-GCM uses a per-value nonce (number used once), not a salt — the PR description provides solid source code references confirming this. The internal link to If you'd like additional reviews or fixes, mention @claude in a comment. |
|
Your site preview for commit bff7c06 is ready! 🎉 http://www-testing-pulumi-docs-origin-pr-18523-bff7c069.s3-website.us-west-2.amazonaws.com |
Docs ReviewScope: Single-line terminology fix in SummaryApproved as a precise, well-sourced correction. The change from "per-value salt" to "per-value nonce" accurately reflects the cryptographic mechanism — AES-256-GCM uses a per-encryption nonce, not a salt. The PR description cites the Pulumi source ( The two concepts are distinct and the prior wording was technically incorrect:
Consistency checkI searched the surrounding docs for other occurrences that might need the same fix:
Style
Nit (optional, non-blocking)For readers unfamiliar with the term, you could consider parenthetically glossing "nonce" the first time it appears — e.g., "a per-value nonce (a number used once)". Purely optional; the linked "Configuring Secrets Encryption" section already provides the deeper context. LGTM. Mention @claude if you'd like another pass or want the nonce gloss added. |
3 participants
Summary
The secrets handling docs described the per-value component of AES-256-GCM encryption as a "salt" when it is actually a "nonce" (number used once). These are distinct cryptographic concepts:
The source code is explicit that this is a nonce:
crypt.go#L157-L158: "The nonce is stored with the value itself as a pair of base64 values separated by a colon"crypt.go#L231-L248: TheencryptAES256GCGMfunction generates a random 12-byte nonce per value and returns it alongside the ciphertext.