eDB Ships AES-XTS At-Rest Encryption — Even on 64 KB Devices
eDB's new storage layer adds page-level AES-XTS encryption with hardware-key offload on supported MCUs. The catch: it had to fit in 6 KB of code on the smallest target.
The constraint
The smallest eDB target is an STM32L0 with 64 KB flash and 8 KB SRAM. The encryption layer had to fit in 6 KB of code, use at most 512 bytes of SRAM for the cipher state, and add no more than 15% throughput overhead on a 32 MHz CPU. These constraints ruled out most existing embedded crypto libraries.
Why AES-XTS
AES-XTS (XEX-based tweaked-codebook mode with ciphertext stealing) is the standard for disk encryption (IEEE P1619). Unlike AES-CBC, XTS is parallelizable and does not propagate errors across pages. Each 512-byte database page is encrypted independently with a tweak derived from the page number, so a single corrupted page does not affect adjacent pages.
Hardware key offload
On MCUs with hardware AES (STM32H7, ESP32-S3, nRF5340), the key never leaves the hardware key store. The CPU provides the plaintext and tweak; the hardware returns ciphertext. The master key is derived from a device-unique secret in OTP using HKDF-SHA256, so it is never stored in flash.
What we cut
To meet the 6 KB code budget, we dropped authenticated encryption (AEAD). eDB uses AES-XTS for confidentiality and a separate HMAC-SHA256 page MAC for integrity. This adds 32 bytes per page (6.25% overhead on 512-byte pages) but keeps the cipher and MAC implementations separate and auditable.
About these articles
How these articles are published
Every article on this site renders through this one page, from the Foundation's shared content registry. The title, date, badge, tags, and body all come from the same data the News page lists — which is why the two can never disagree about what an article says or when it appeared.
The registry replaced eight separate article pages whose metadata had drifted apart: seven of them showed a different publication date than the news listing. One source of truth is less interesting than eight bespoke pages, and considerably more honest.
What an article is
Articles are the long form: explanations of how something works, technical writing about the stack, and reflections on the work. News carries the timely announcement; the article carries the full treatment — the reasoning, the context, and the detail that would not fit in a listing.
Each article states its assumptions and links its evidence where evidence exists. The source material behind the technical claims — the code, the measurements, the filings — is public in the Foundation's repositories.
Dates and addresses
The date on an article is its publication date. The address is /article/ followed by the article's slug, and the older /article-xxx addresses from the previous site still resolve to the same pages — nothing already linked or indexed breaks.
If an article is corrected after publication, the correction is noted rather than silently made — the same standard our press releases are held to. The page you are reading is the current version, and the record of what changed stays with it.