05 / ENCRYPTION

Compress first.
Seal the value.

Encrypted RIDA builds compress every value, then seal it with AES-256-GCM. A fresh nonce is used for every value; a 12-byte nonce plus a 16-byte tag adds 28 bytes per value.

THE THREE OUTPUTS

Keep the key out of the CDN.

A public data file can contain ciphertext. The index remains with the reader. The key is a separate private file or secret.

pip install rida-format
rida build ./my-data ItemsData.rida --encrypt

01ItemsData.rida

Encrypted values

Each value is deflate-compressed and then sealed. A scraper can download bytes but cannot read them without the key.

02ItemsIndex.rida

Plain catalog

The reader needs the catalog locally. It can reveal record count, field names, codec and structure.

03ItemsKey.rida

Private 256-bit key

Keep it away from public storage. A client that already has the key can still be studied.

DIRECT ENCRYPTED DELIVERY

Encrypted data.
Direct from your CDN.

Let an authorised reader request encrypted RIDA values directly from your CDN and decrypt them on the user’s device. When a proxy exists only to validate a token before each read, this approach can remove that proxy from the delivery path.

Reader with a keyRecord ID + field

→

Your CDNEncrypted byte range

→

Local decryptionThe requested value

Direct delivery

The reader uses its catalogue to request the right range. A separate Worker or backend does not have to validate every read when access is based on possession of the key.

Encrypted content

The URL can be publicly reachable. Someone without the key can download the ciphertext but cannot decrypt its values. The catalogue can still reveal field names and record structure.

Fewer processing steps

You may avoid execution charges and an extra network hop for a proxy used only for token validation. RIDA adds no encryption fee; storage, CDN traffic and any remaining services can still cost money.

Choose where decryption happens.

KEY WITH THE READER

Read directly. Decrypt locally.

Give an authorised device a key through your own access flow. A compatible reader then fetches values directly from the CDN, without sending every read through your application server.

A key delivered to a browser or app is accessible to someone who controls that device. Treat it as a credential that can be copied, rather than a permanently hidden secret. The current npm reader runs in Node.js; browser and mobile clients need a compatible implementation.

KEY ON YOUR SERVER

Keep the key out of the browser.

In Next.js, store the key in a server-only environment variable such as RIDA_KEY. Do not use a NEXT_PUBLIC_ prefix, expose the key in a response, or import it into client code.

Your server checks access, fetches the encrypted range, decrypts it and returns the permitted content. Each read passes through the server in this setup, so server execution and traffic still apply.

ONE PAGE. ONE LANGUAGE.

Fetch Spanish. Leave the other languages on the CDN.

A page record can contain English, Hindi, Urdu and Spanish values. To display Spanish, a reader with the key requests only that field’s encrypted range and decrypts the complete Spanish value. The range size depends on the stored content; a long page requires a larger read.

Explore field reads

Encryption protects readable content; it does not enforce a separate permission check for every request. Someone who has the key can read the values encrypted with it. Expiring a session token does not revoke a copied key: excluding an old key from future data requires a new key and newly encrypted data. This pattern suits applications that accept that trade-off; it does not automatically replace every CDN security feature or paid plan.

INTEGRITY

The key is also the checksum.

If one byte in the nonce, ciphertext or tag changes, GCM authentication fails. verify() also checks data length, the SHA-256 digest in the index and catalog decoding.

What encryption does

Stops a reader who does not hold the key from reading values in a public CDN file.

What it does not do

It does not enforce account permissions or revoke a copied key. Keep decryption on your server when each read needs an access check.

Included with your install

pip install rida-format installs encryption support automatically. No separate extra is needed.

Read an encrypted dataset with its key

The key file contains a 256-bit key encoded as 44 characters of URL-safe base64. Read the text and strip the trailing newline before passing it to a reader.

from pathlib import Path
import rida

key = Path("ItemsKey.rida").read_text().strip()

with rida.RidaFile("ItemsData.rida", key=key) as data:
    print(data.get("item-101", "title"))

with rida.RemoteRidaFile(
    "https://data.example.com/ItemsData.rida",
    index="ItemsIndex.rida",
    key=key,
) as data:
    print(data.get_record("item-101"))

rida get ItemsData.rida item-101 title --key "$(cat ItemsKey.rida)"
rida remote-get https://data.example.com/ItemsData.rida item-101 title --index ItemsIndex.rida --key "$(cat ItemsKey.rida)"

Encryption adds 28 bytes to every stored value. The manual’s reference build measured about 8.6 microseconds of additional encryption work per value; your data and machine will differ.

Use rida.encryption_available() to check whether the optional cryptography package is installed before offering an encrypted build. An app that holds the key can decrypt the data, and someone who extracts that key can do the same. RIDA does not manage user accounts or key delivery.

Compress first.Seal the value.