feat: replace private cas envelope

crates/geth-node/src/lib.rs

@@ -6174,21 +6174,10 @@ pub fn handle_request(
             })?;
             let plaintext = std::fs::read(&path)?;
             let plaintext_hash = geth_cas::hash_bytes(&plaintext);
-            let nonce = geth_crypto::blake3_hex(
-                format!(
-                    "{}\0{}\0{}\0{}",
-                    resource,
-                    secret.secret_id,
-                    secret.epoch,
-                    geth_store::now_ms()
-                )
-                .as_bytes(),
-            );
             let encrypted = geth_cas::encrypt_private_blob(
                 &resource,
                 &secret.secret_id,
                 secret.epoch,
-                &nonce,
                 &plaintext,
             )?;
             let cas = LocalCas::new(node.paths.cas_dir());
@@ -6204,7 +6193,7 @@ pub fn handle_request(
                 plaintext_hash,
                 encrypted_hash: info.hash,
                 size_bytes: info.size_bytes,
-                note: "stored prototype encrypted private blob envelope; no forward secrecy or post-compromise security is claimed".to_owned(),
+                note: "stored AES-256-GCM private blob envelope bound to the resource and secret epoch; no forward secrecy or post-compromise security is claimed".to_owned(),
             })
         }
         ControlRequest::CasGet { hash, out } => {
@@ -6258,7 +6247,9 @@ pub fn handle_request(
                 plaintext_hash: geth_cas::hash_bytes(&plaintext),
                 out,
                 size_bytes: plaintext.len() as u64,
-                note: "decrypted prototype private blob envelope with the latest local resource secret epoch".to_owned(),
+                note:
+                    "decrypted AES-256-GCM private blob envelope with a local resource secret epoch"
+                        .to_owned(),
             })
         }
         ControlRequest::CasHash { path } => Ok(ControlResponse::CasHash {