> ## Documentation Index
> Fetch the complete documentation index at: https://docs-unity.molca.id/llms.txt
> Use this file to discover all available pages before exploring further.

# Encryption

> Local AES-256-CBC at-rest obfuscation for cache files and a removed public-key encryption flow.

**Namespace:** `Molca.Networking.Utils`\
**File:** `Packages/com.molca.core/Runtime/Networking/Utils/Encryption.cs`\
**Type:** `RuntimeSubsystem` (child of [RuntimeManager](/core/runtime-manager) prefab)

## When to use

Use `Encryption` for local at-rest obfuscation of cache data written by [CacheManager](/core/cache-manager). For sensitive credentials, use [SecureStorage](/core/secure-storage) instead.

> ⚠️ This is **at-rest obfuscation, not strong cryptography.** The AES key is derived from the configured public-key asset (or `deviceUniqueIdentifier` as fallback) — both are non-secret material available to the running app.

## Role

* **Local AES-256-CBC encryption** — `EncryptData`/`DecryptData` encrypt/decrypt byte arrays for cache file storage. IV is randomly generated per operation and prepended to the output.
* **Key derivation** — uses SHA-256 of the configured PEM public key (extracted from `-----BEGIN PUBLIC KEY-----` markers) or, if absent, `SystemInfo.deviceUniqueIdentifier`.
* **Public-key string flow removed** — `EncryptString`/`DecryptString` are `[Obsolete]` and throw `NotSupportedException`. This flow was removed in Sprint 4.6 because it relied on RSA decryption with a *public* key, which is cryptographically impossible.

## Inspector configuration

| Field        | Type        | Purpose                                               |
| ------------ | ----------- | ----------------------------------------------------- |
| `_publicKey` | `TextAsset` | PEM-encoded public key for key derivation (optional). |

## API Reference

| Method          | Signature                                                                  | Description                                                        |
| --------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| `EncryptData`   | `static byte[] EncryptData(byte[] data)`                                   | Encrypt data with local AES key. IV is prepended to the output.    |
| `DecryptData`   | `static byte[] DecryptData(byte[] encryptedData)`                          | Decrypt data produced by `EncryptData`. First 16 bytes are the IV. |
| `EncryptString` | `[Obsolete] static Awaitable<EncryptionResult> EncryptString(string data)` | **Removed.** Throws `NotSupportedException`.                       |
| `DecryptString` | `[Obsolete] static string DecryptString(string data, byte[] symKey)`       | **Removed.** Throws `NotSupportedException`.                       |

## Code

```csharp theme={null}
using Molca.Networking.Utils;
using UnityEngine;

public class CacheHelper : MonoBehaviour
{
    public byte[] EncryptForCache(byte[] rawData)
    {
        return Encryption.EncryptData(rawData);
    }

    public byte[] DecryptFromCache(byte[] encryptedData)
    {
        return Encryption.DecryptData(encryptedData);
    }
}
```

## Troubleshooting

* **`EncryptString`/`DecryptString` throw `NotSupportedException`:** these methods were removed. Use `EncryptData`/`DecryptData` for byte-level encryption, or `SecureStorage` for credentials.
* **Different device, different key:** without a configured `_publicKey` TextAsset, the key derives from `deviceUniqueIdentifier`, meaning cache files are not portable across devices.

## Related

* [CacheManager](/core/cache-manager) — consumes Encryption for cache file obfuscation
* [SecureStorage](/core/secure-storage) — encrypted storage for credentials (preferred for sensitive data)
* [RuntimeManager](/core/runtime-manager) — `Encryption` is a child subsystem