Skip to content

How to Decrypt Logs

Encrypted Silo log entries (type: "ENC") contain ciphertext that must be decrypted with your organization's private key before they can be read.

When do you need this?

Not all organizations use encrypted logs. If your log extractions don't contain ENC type entries, you don't need to set up decryption.

Prerequisites

# From your SDK installation directory
pip install -e ".[decrypt]"

# From your SDK installation directory
pip install -e ".[legacy-decrypt]"

Private Key Setup

Keys are stored in pvtkey.txt in name=value format:

# pvtkey.txt — keep this file secure, never commit it
primary_key=base64-encoded-private-key-here
backup_key=another-base64-encoded-key-here

Manage keys with the key manager script:

# Add a key
python scripts/key_manager.py add-key primary_key /path/to/private.pem

# List stored keys
python scripts/key_manager.py list-keys

# Remove a key
python scripts/key_manager.py remove-key primary_key

Decrypt During Extraction

The simplest approach — decrypt log entries as they are extracted:

from silo_sdk import LogExtractionAPI, load_config
from silo_sdk.logging.decrypt import load_private_keys, decrypt_logs

config = load_config("config/default.json")
logs = LogExtractionAPI(config)

# Load private keys
keys = load_private_keys("pvtkey.txt")

# Extract logs (includes ENC entries)
records = logs.extract_all_logs(org="my_org", log_types=["AUTH", "ENC"])

# Decrypt all ENC entries in-place
decrypted = decrypt_logs(records, keys)
for record in decrypted:
    print(record)  # ENC entries now contain decrypted plaintext

Decrypt a Single Entry

from silo_sdk.logging.decrypt import load_private_keys, decrypt_log_entry

keys = load_private_keys("pvtkey.txt")

enc_entry = {
    "type": "ENC",
    "ciphertext": "base64-encoded-ciphertext...",
    "key_name": "primary_key",
}

decrypted = decrypt_log_entry(enc_entry, keys)
print(decrypted)  # dict with decrypted fields

Decrypt Stored ENC Files Offline

If you've already exported ENC log files to disk, use scripts/decrypt_files.py:

# Decrypt all ENC*.json files in current directory
python scripts/decrypt_files.py --pvtkey pvtkey.txt

# Decrypt from a specific directory
python scripts/decrypt_files.py --pvtkey pvtkey.txt --dir /path/to/enc/logs

# Custom file mask and output format
python scripts/decrypt_files.py \
    --pvtkey pvtkey.txt \
    --file-mask "session_*.json" \
    --output-dir ./decrypted/ \
    --format csv

# Include raw ENC blocks for entries that fail to decrypt
python scripts/decrypt_files.py --pvtkey pvtkey.txt --show-enc

Decrypt Video Files

For encrypted video recordings:

from silo_sdk.logging.decrypt import load_private_keys, decrypt_video_file

keys = load_private_keys("pvtkey.txt")

decrypt_video_file(
    video_path="encrypted_recording.enc",
    output_path="recording.mp4",
    key_name="primary_key",
    keys=keys,
)

The function uses a temp file + atomic move — if decryption fails, the output file is not written.

Ciphertext Format Reference

Standard encryption layout:

Bytes   0–11  : 12-byte GCM nonce (IV)
Bytes  12–102 : 91-byte DER ephemeral EC public key (P-256)
Bytes 103–118 : 16-byte GCM authentication tag
Bytes  119+   : AES-256-GCM encrypted payload

For large payloads, use standard_decrypt_chunked() with 32 MB chunks — auth-tag is verified only on finalize().