Mutamad Crypto

Cryptography, key management and multi-factor authentication for Mutamad:

• authenticated AES-256 encryption (Real AES), with keys held outside the database and the web root
• multi-factor authentication with an authenticator app and recovery codes, whose secrets those keys protect

No key, salt or credential is shipped: each site generates its own. Aligned to NCA ECC-2:2024 2-2-2 and the cryptography controls.

Part of Mutamad

Part of Mutamad, the Drupal distribution for Saudi government websites. Mutamad Standard Site applies it on every Mutamad site.

Requirements

• Drupal 11.4
• encrypt
• key
• real_aes
• tfa
• a private file path and its key file

Installation

Set a private file path in settings.php first, outside the web root: $settings['file_private_path'] = '../private';

Then create the key file: see "Keys are not configuration" in Mutamad Crypto's README.

composer require drupal/mutamad_crypto 'drupal/tfa:^2.0@alpha'

Sites started from the Mutamad project template already allow the alpha modules in this command, and can skip it.

drush recipe ../recipes/mutamad_crypto

Documentation

The README explains every setting and why, and the changelog what changed in each release.