Keep content encrypted in storage
01HTTP content coding transforms the message body. aes128gcm keeps content encrypted after a network connection ends; a recipient needs separately acquired keying material.
Every holder of the content-encryption key can create valid encrypted content. A successful tag check is not a digital signature by a unique sender, and does not authorize writes to a storage service.
Source for this drawing: RFC 8188 · Read RFC section 1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Payload encryption complements TLS and can protect stored copies from a service without the key. It does not define key management or encrypt ordinary HTTP fields.
Read the updated RFC section ↗TLS protects a connection. Payload encryption can also protect copies stored or forwarded by a service that does not know the key; it complements TLS.
- TLS protects a connection. Payload encryption can also protect copies stored or forwarded by a service that does not know the key; it complements TLS.
- AES-GCM means Advanced Encryption Standard in Galois/Counter Mode. It encrypts data and adds an authentication tag; its content-encryption key is 128 bits.
- Key management is outside this RFC. A valid tag identifies possession of the shared content-encryption key, not one individual sender. Storage write authentication and authorization remain separate.
- Accept-Encoding can negotiate this fixed coding. Other cryptographic algorithm choices require a different content-coding scheme, not an aes128gcm algorithm parameter.
Published test keys are examples, not secrets to use. This guide does not implement key management or a production cryptographic library.
Read the RFC section ↗