From accb2df6cb0202ac2c178b89c21eff604bcd5b40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
Date: Mon, 20 May 2024 23:17:32 +0200
Subject: [PATCH] Document SensitiveParameter attributes - part 2

---
 reference/pdo/pdo/construct.xml                             | 2 +-
 reference/sodium/functions/sodium-base642bin.xml            | 4 ++--
 reference/sodium/functions/sodium-bin2base64.xml            | 4 ++--
 reference/sodium/functions/sodium-bin2hex.xml               | 4 ++--
 reference/sodium/functions/sodium-compare.xml               | 4 ++--
 .../functions/sodium-crypto-aead-aes256gcm-decrypt.xml      | 4 ++--
 .../functions/sodium-crypto-aead-aes256gcm-encrypt.xml      | 6 +++---
 .../sodium-crypto-aead-chacha20poly1305-decrypt.xml         | 4 ++--
 .../sodium-crypto-aead-chacha20poly1305-encrypt.xml         | 6 +++---
 .../sodium-crypto-aead-chacha20poly1305-ietf-decrypt.xml    | 4 ++--
 .../sodium-crypto-aead-chacha20poly1305-ietf-encrypt.xml    | 6 +++---
 .../sodium-crypto-aead-xchacha20poly1305-ietf-decrypt.xml   | 4 ++--
 .../sodium-crypto-aead-xchacha20poly1305-ietf-encrypt.xml   | 6 +++---
 reference/sodium/functions/sodium-crypto-auth-verify.xml    | 2 +-
 reference/sodium/functions/sodium-crypto-auth.xml           | 2 +-
 ...dium-crypto-box-keypair-from-secretkey-and-publickey.xml | 4 +---
 reference/sodium/functions/sodium-crypto-box-open.xml       | 2 +-
 .../sodium-crypto-box-publickey-from-secretkey.xml          | 2 +-
 reference/sodium/functions/sodium-crypto-box-publickey.xml  | 2 +-
 reference/sodium/functions/sodium-crypto-box-seal-open.xml  | 2 +-
 reference/sodium/functions/sodium-crypto-box-seal.xml       | 2 +-
 reference/sodium/functions/sodium-crypto-box-secretkey.xml  | 2 +-
 .../sodium/functions/sodium-crypto-box-seed-keypair.xml     | 2 +-
 reference/sodium/functions/sodium-crypto-box.xml            | 4 ++--
 .../sodium/functions/sodium-crypto-generichash-init.xml     | 2 +-
 reference/sodium/functions/sodium-crypto-generichash.xml    | 2 +-
 .../sodium/functions/sodium-crypto-kdf-derive-from-key.xml  | 2 +-
 .../functions/sodium-crypto-kx-client-session-keys.xml      | 2 +-
 reference/sodium/functions/sodium-crypto-kx-publickey.xml   | 2 +-
 reference/sodium/functions/sodium-crypto-kx-secretkey.xml   | 2 +-
 .../sodium/functions/sodium-crypto-kx-seed-keypair.xml      | 2 +-
 .../functions/sodium-crypto-kx-server-session-keys.xml      | 2 +-
 ...sodium-crypto-pwhash-scryptsalsa208sha256-str-verify.xml | 4 +---
 .../sodium-crypto-pwhash-scryptsalsa208sha256-str.xml       | 4 +---
 .../functions/sodium-crypto-pwhash-scryptsalsa208sha256.xml | 4 +---
 .../sodium/functions/sodium-crypto-pwhash-str-verify.xml    | 4 +---
 reference/sodium/functions/sodium-crypto-pwhash-str.xml     | 2 +-
 reference/sodium/functions/sodium-crypto-pwhash.xml         | 2 +-
 reference/sodium/functions/sodium-crypto-secretbox-open.xml | 2 +-
 reference/sodium/functions/sodium-crypto-secretbox.xml      | 4 ++--
 ...dium-crypto-secretstream-xchacha20poly1305-init-pull.xml | 4 +---
 ...dium-crypto-secretstream-xchacha20poly1305-init-push.xml | 4 +---
 .../sodium-crypto-secretstream-xchacha20poly1305-push.xml   | 4 ++--
 reference/sodium/functions/sodium-crypto-shorthash.xml      | 2 +-
 reference/sodium/functions/sodium-crypto-sign-detached.xml  | 2 +-
 .../sodium-crypto-sign-ed25519-sk-to-curve25519.xml         | 4 ++--
 ...ium-crypto-sign-keypair-from-secretkey-and-publickey.xml | 4 +---
 .../sodium-crypto-sign-publickey-from-secretkey.xml         | 2 +-
 reference/sodium/functions/sodium-crypto-sign-publickey.xml | 2 +-
 reference/sodium/functions/sodium-crypto-sign-secretkey.xml | 2 +-
 .../sodium/functions/sodium-crypto-sign-seed-keypair.xml    | 2 +-
 reference/sodium/functions/sodium-crypto-sign.xml           | 2 +-
 .../functions/sodium-crypto-stream-xchacha20-xor-ic.xml     | 6 +++---
 .../sodium/functions/sodium-crypto-stream-xchacha20-xor.xml | 4 ++--
 .../sodium/functions/sodium-crypto-stream-xchacha20.xml     | 2 +-
 reference/sodium/functions/sodium-crypto-stream-xor.xml     | 4 ++--
 reference/sodium/functions/sodium-crypto-stream.xml         | 4 +---
 reference/sodium/functions/sodium-hex2bin.xml               | 4 ++--
 reference/sodium/functions/sodium-memcmp.xml                | 4 ++--
 reference/sodium/functions/sodium-memzero.xml               | 2 +-
 reference/sodium/functions/sodium-pad.xml                   | 2 +-
 reference/sodium/functions/sodium-unpad.xml                 | 2 +-
 reference/strings/functions/crypt.xml                       | 2 +-
 reference/zip/ziparchive/setencryptionindex.xml             | 2 +-
 reference/zip/ziparchive/setencryptionname.xml              | 2 +-
 reference/zip/ziparchive/setpassword.xml                    | 2 +-
 66 files changed, 92 insertions(+), 110 deletions(-)

diff --git a/reference/pdo/pdo/construct.xml b/reference/pdo/pdo/construct.xml
index dd097c3a4ae6..27289c2ac4e1 100644
--- a/reference/pdo/pdo/construct.xml
+++ b/reference/pdo/pdo/construct.xml
@@ -13,7 +13,7 @@
    <modifier>public</modifier> <methodname>PDO::__construct</methodname>
    <methodparam><type>string</type><parameter>dsn</parameter></methodparam>
    <methodparam choice="opt"><type class="union"><type>string</type><type>null</type></type><parameter>username</parameter><initializer>&null;</initializer></methodparam>
-   <methodparam choice="opt"><type class="union"><type>string</type><type>null</type></type><parameter>password</parameter><initializer>&null;</initializer></methodparam>
+   <methodparam choice="opt"><modifier role="attribute">#[\SensitiveParameter]</modifier><type class="union"><type>string</type><type>null</type></type><parameter>password</parameter><initializer>&null;</initializer></methodparam>
    <methodparam choice="opt"><type class="union"><type>array</type><type>null</type></type><parameter>options</parameter><initializer>&null;</initializer></methodparam>
   </constructorsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-base642bin.xml b/reference/sodium/functions/sodium-base642bin.xml
index 47bf0f80ad9a..23cbcc9c489b 100644
--- a/reference/sodium/functions/sodium-base642bin.xml
+++ b/reference/sodium/functions/sodium-base642bin.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-base642bin">
+<refentry xml:id="function.sodium-base642bin" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_base642bin</refname>
   <refpurpose>Decodes a base64-encoded string into raw binary.</refpurpose>
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_base642bin</methodname>
-   <methodparam><type>string</type><parameter>string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string</parameter></methodparam>
    <methodparam><type>int</type><parameter>id</parameter></methodparam>
    <methodparam choice="opt"><type>string</type><parameter>ignore</parameter><initializer>""</initializer></methodparam>
   </methodsynopsis>
diff --git a/reference/sodium/functions/sodium-bin2base64.xml b/reference/sodium/functions/sodium-bin2base64.xml
index f29c29a59bc6..988e1bd5d429 100644
--- a/reference/sodium/functions/sodium-bin2base64.xml
+++ b/reference/sodium/functions/sodium-bin2base64.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-bin2base64">
+<refentry xml:id="function.sodium-bin2base64" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_bin2base64</refname>
   <refpurpose>Encodes a raw binary string with base64.</refpurpose>
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_bin2base64</methodname>
-   <methodparam><type>string</type><parameter>string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string</parameter></methodparam>
    <methodparam><type>int</type><parameter>id</parameter></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-bin2hex.xml b/reference/sodium/functions/sodium-bin2hex.xml
index 7fbbd6622815..f34bb0bf6c60 100644
--- a/reference/sodium/functions/sodium-bin2hex.xml
+++ b/reference/sodium/functions/sodium-bin2hex.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-bin2hex">
+<refentry xml:id="function.sodium-bin2hex" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_bin2hex</refname>
   <refpurpose>Encode to hexadecimal</refpurpose>
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_bin2hex</methodname>
-   <methodparam><type>string</type><parameter>string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string</parameter></methodparam>
   </methodsynopsis>
   <para>
    Converts a raw binary string into a hex-encoded string. Unlike the standard hex-encoding function,
diff --git a/reference/sodium/functions/sodium-compare.xml b/reference/sodium/functions/sodium-compare.xml
index 0a5dd56fe4f2..55fb9a2afdd7 100644
--- a/reference/sodium/functions/sodium-compare.xml
+++ b/reference/sodium/functions/sodium-compare.xml
@@ -10,8 +10,8 @@
   &reftitle.description;
   <methodsynopsis>
    <type>int</type><methodname>sodium_compare</methodname>
-   <methodparam><type>string</type><parameter>string1</parameter></methodparam>
-   <methodparam><type>string</type><parameter>string2</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string1</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string2</parameter></methodparam>
   </methodsynopsis>
   <para>
    Compare two strings as if they were arbitrary-length, unsigned little-endian integers, without side-channel leakage.
diff --git a/reference/sodium/functions/sodium-crypto-aead-aes256gcm-decrypt.xml b/reference/sodium/functions/sodium-crypto-aead-aes256gcm-decrypt.xml
index d6c7660aad70..95508245f090 100644
--- a/reference/sodium/functions/sodium-crypto-aead-aes256gcm-decrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-aes256gcm-decrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-aes256gcm-decrypt">
+<refentry xml:id="function.sodium-crypto-aead-aes256gcm-decrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_aes256gcm_decrypt</refname>
   <refpurpose>Verify then decrypt a message with AES-256-GCM</refpurpose>
@@ -13,7 +13,7 @@
    <methodparam><type>string</type><parameter>ciphertext</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Verify then decrypt with AES-256-GCM.
diff --git a/reference/sodium/functions/sodium-crypto-aead-aes256gcm-encrypt.xml b/reference/sodium/functions/sodium-crypto-aead-aes256gcm-encrypt.xml
index bf12152dcab2..17d7ed3bdea7 100644
--- a/reference/sodium/functions/sodium-crypto-aead-aes256gcm-encrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-aes256gcm-encrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-aes256gcm-encrypt">
+<refentry xml:id="function.sodium-crypto-aead-aes256gcm-encrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_aes256gcm_encrypt</refname>
   <refpurpose>Encrypt then authenticate with AES-256-GCM</refpurpose>
@@ -10,10 +10,10 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_aead_aes256gcm_encrypt</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Encrypt then authenticate with AES-256-GCM.
diff --git a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-decrypt.xml b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-decrypt.xml
index 9d97c38bdf66..f9a9177b77c2 100644
--- a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-decrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-decrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-chacha20poly1305-decrypt">
+<refentry xml:id="function.sodium-crypto-aead-chacha20poly1305-decrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_chacha20poly1305_decrypt</refname>
   <refpurpose>Verify then decrypt with ChaCha20-Poly1305</refpurpose>
@@ -13,7 +13,7 @@
    <methodparam><type>string</type><parameter>ciphertext</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Verify then decrypt with ChaCha20-Poly1305.
diff --git a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-encrypt.xml b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-encrypt.xml
index 6f6fdc765707..586609dc11dd 100644
--- a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-encrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-encrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-chacha20poly1305-encrypt">
+<refentry xml:id="function.sodium-crypto-aead-chacha20poly1305-encrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_chacha20poly1305_encrypt</refname>
   <refpurpose>Encrypt then authenticate with ChaCha20-Poly1305</refpurpose>
@@ -10,10 +10,10 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_aead_chacha20poly1305_encrypt</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Encrypt then authenticate with ChaCha20-Poly1305.
diff --git a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-decrypt.xml b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-decrypt.xml
index 722bcb923b6c..886c73805298 100644
--- a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-decrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-decrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-chacha20poly1305-ietf-decrypt">
+<refentry xml:id="function.sodium-crypto-aead-chacha20poly1305-ietf-decrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_chacha20poly1305_ietf_decrypt</refname>
   <refpurpose>Verify that the ciphertext includes a valid tag</refpurpose>
@@ -13,7 +13,7 @@
    <methodparam><type>string</type><parameter>ciphertext</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Verify then decrypt with ChaCha20-Poly1305 (IETF variant).
diff --git a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-encrypt.xml b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-encrypt.xml
index 0475e668c019..27c91401f8bc 100644
--- a/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-encrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-chacha20poly1305-ietf-encrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-chacha20poly1305-ietf-encrypt">
+<refentry xml:id="function.sodium-crypto-aead-chacha20poly1305-ietf-encrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_chacha20poly1305_ietf_encrypt</refname>
   <refpurpose>Encrypt a message</refpurpose>
@@ -10,10 +10,10 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_aead_chacha20poly1305_ietf_encrypt</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Encrypt then authenticate with ChaCha20-Poly1305 (IETF variant).
diff --git a/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-decrypt.xml b/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-decrypt.xml
index b5a12967b2ca..7beb6fc2e46b 100644
--- a/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-decrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-decrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-xchacha20poly1305-ietf-decrypt">
+<refentry xml:id="function.sodium-crypto-aead-xchacha20poly1305-ietf-decrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_xchacha20poly1305_ietf_decrypt</refname>
   <refpurpose>(Preferred) Verify then decrypt with XChaCha20-Poly1305</refpurpose>
@@ -13,7 +13,7 @@
    <methodparam><type>string</type><parameter>ciphertext</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
 
diff --git a/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-encrypt.xml b/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-encrypt.xml
index b1ea0854ea03..31ced0624ada 100644
--- a/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-encrypt.xml
+++ b/reference/sodium/functions/sodium-crypto-aead-xchacha20poly1305-ietf-encrypt.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-aead-xchacha20poly1305-ietf-encrypt">
+<refentry xml:id="function.sodium-crypto-aead-xchacha20poly1305-ietf-encrypt" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_aead_xchacha20poly1305_ietf_encrypt</refname>
   <refpurpose>(Preferred) Encrypt then authenticate with XChaCha20-Poly1305</refpurpose>
@@ -10,10 +10,10 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_aead_xchacha20poly1305_ietf_encrypt</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>additional_data</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Encrypt then authenticate with XChaCha20-Poly1305 (eXtended-nonce variant).
diff --git a/reference/sodium/functions/sodium-crypto-auth-verify.xml b/reference/sodium/functions/sodium-crypto-auth-verify.xml
index 460e112acf94..52501ba2b509 100644
--- a/reference/sodium/functions/sodium-crypto-auth-verify.xml
+++ b/reference/sodium/functions/sodium-crypto-auth-verify.xml
@@ -12,7 +12,7 @@
    <type>bool</type><methodname>sodium_crypto_auth_verify</methodname>
    <methodparam><type>string</type><parameter>mac</parameter></methodparam>
    <methodparam><type>string</type><parameter>message</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Verify the authentication tag is valid for a given message and key.
diff --git a/reference/sodium/functions/sodium-crypto-auth.xml b/reference/sodium/functions/sodium-crypto-auth.xml
index dbd4fb168f67..e8697bd067fd 100644
--- a/reference/sodium/functions/sodium-crypto-auth.xml
+++ b/reference/sodium/functions/sodium-crypto-auth.xml
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_auth</methodname>
    <methodparam><type>string</type><parameter>message</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Symmetric message authentication via <function>sodium_crypto_auth</function> provides
diff --git a/reference/sodium/functions/sodium-crypto-box-keypair-from-secretkey-and-publickey.xml b/reference/sodium/functions/sodium-crypto-box-keypair-from-secretkey-and-publickey.xml
index a7a4251327ea..426717c5b030 100644
--- a/reference/sodium/functions/sodium-crypto-box-keypair-from-secretkey-and-publickey.xml
+++ b/reference/sodium/functions/sodium-crypto-box-keypair-from-secretkey-and-publickey.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-box-keypair-from-secretkey-and-publickey" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_box_keypair_from_secretkey_and_publickey</refname>
@@ -11,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_box_keypair_from_secretkey_and_publickey</methodname>
-   <methodparam><type>string</type><parameter>secret_key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>secret_key</parameter></methodparam>
    <methodparam><type>string</type><parameter>public_key</parameter></methodparam>
   </methodsynopsis>
   <para>
@@ -53,7 +52,6 @@
 
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-box-open.xml b/reference/sodium/functions/sodium-crypto-box-open.xml
index 2a39986cc9d1..efe759c42536 100644
--- a/reference/sodium/functions/sodium-crypto-box-open.xml
+++ b/reference/sodium/functions/sodium-crypto-box-open.xml
@@ -12,7 +12,7 @@
    <type class="union"><type>string</type><type>false</type></type><methodname>sodium_crypto_box_open</methodname>
    <methodparam><type>string</type><parameter>ciphertext</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Decrypt a message using asymmetric (public key) cryptography.
diff --git a/reference/sodium/functions/sodium-crypto-box-publickey-from-secretkey.xml b/reference/sodium/functions/sodium-crypto-box-publickey-from-secretkey.xml
index dc95b742d10a..dc675e5fc65f 100644
--- a/reference/sodium/functions/sodium-crypto-box-publickey-from-secretkey.xml
+++ b/reference/sodium/functions/sodium-crypto-box-publickey-from-secretkey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_box_publickey_from_secretkey</methodname>
-   <methodparam><type>string</type><parameter>secret_key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>secret_key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Given a secret key, calculate the corresponding public key.
diff --git a/reference/sodium/functions/sodium-crypto-box-publickey.xml b/reference/sodium/functions/sodium-crypto-box-publickey.xml
index f7a0c3f85779..a6e69aa70df4 100644
--- a/reference/sodium/functions/sodium-crypto-box-publickey.xml
+++ b/reference/sodium/functions/sodium-crypto-box-publickey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_box_publickey</methodname>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Given a keypair, fetch only the public key.
diff --git a/reference/sodium/functions/sodium-crypto-box-seal-open.xml b/reference/sodium/functions/sodium-crypto-box-seal-open.xml
index 4de9703e4380..670b6d4f599f 100644
--- a/reference/sodium/functions/sodium-crypto-box-seal-open.xml
+++ b/reference/sodium/functions/sodium-crypto-box-seal-open.xml
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type class="union"><type>string</type><type>false</type></type><methodname>sodium_crypto_box_seal_open</methodname>
    <methodparam><type>string</type><parameter>ciphertext</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Decrypt a message that was encrypted with <function>sodium_crypto_box_seal</function>
diff --git a/reference/sodium/functions/sodium-crypto-box-seal.xml b/reference/sodium/functions/sodium-crypto-box-seal.xml
index 0a8f91596004..40cd737c5cbd 100644
--- a/reference/sodium/functions/sodium-crypto-box-seal.xml
+++ b/reference/sodium/functions/sodium-crypto-box-seal.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_box_seal</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>public_key</parameter></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-crypto-box-secretkey.xml b/reference/sodium/functions/sodium-crypto-box-secretkey.xml
index 1afb2f080844..f4c8dc878d8c 100644
--- a/reference/sodium/functions/sodium-crypto-box-secretkey.xml
+++ b/reference/sodium/functions/sodium-crypto-box-secretkey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_box_secretkey</methodname>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Given a keypair, fetch only the secret key.
diff --git a/reference/sodium/functions/sodium-crypto-box-seed-keypair.xml b/reference/sodium/functions/sodium-crypto-box-seed-keypair.xml
index a1f1cc680824..4d0da8ee2fae 100644
--- a/reference/sodium/functions/sodium-crypto-box-seed-keypair.xml
+++ b/reference/sodium/functions/sodium-crypto-box-seed-keypair.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_box_seed_keypair</methodname>
-   <methodparam><type>string</type><parameter>seed</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>seed</parameter></methodparam>
   </methodsynopsis>
   <para>
    Clamps the seed to form a secret key, derives the public key, and returns the two as a keypair.
diff --git a/reference/sodium/functions/sodium-crypto-box.xml b/reference/sodium/functions/sodium-crypto-box.xml
index c533b6bee795..67146bbf6910 100644
--- a/reference/sodium/functions/sodium-crypto-box.xml
+++ b/reference/sodium/functions/sodium-crypto-box.xml
@@ -10,9 +10,9 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_box</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Encrypt a message using asymmetric (public key) cryptography.
diff --git a/reference/sodium/functions/sodium-crypto-generichash-init.xml b/reference/sodium/functions/sodium-crypto-generichash-init.xml
index 3305bcd4f0df..ab87be94b79c 100644
--- a/reference/sodium/functions/sodium-crypto-generichash-init.xml
+++ b/reference/sodium/functions/sodium-crypto-generichash-init.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_generichash_init</methodname>
-   <methodparam choice="opt"><type>string</type><parameter>key</parameter><initializer>""</initializer></methodparam>
+   <methodparam choice="opt"><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter><initializer>""</initializer></methodparam>
    <methodparam choice="opt"><type>int</type><parameter>length</parameter><initializer><constant>SODIUM_CRYPTO_GENERICHASH_BYTES</constant></initializer></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-crypto-generichash.xml b/reference/sodium/functions/sodium-crypto-generichash.xml
index f30c86be53c0..bef5857d9fa2 100644
--- a/reference/sodium/functions/sodium-crypto-generichash.xml
+++ b/reference/sodium/functions/sodium-crypto-generichash.xml
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_generichash</methodname>
    <methodparam><type>string</type><parameter>message</parameter></methodparam>
-   <methodparam choice="opt"><type>string</type><parameter>key</parameter><initializer>""</initializer></methodparam>
+   <methodparam choice="opt"><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter><initializer>""</initializer></methodparam>
    <methodparam choice="opt"><type>int</type><parameter>length</parameter><initializer><constant>SODIUM_CRYPTO_GENERICHASH_BYTES</constant></initializer></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-crypto-kdf-derive-from-key.xml b/reference/sodium/functions/sodium-crypto-kdf-derive-from-key.xml
index 953fe5aaa60c..ee5f2ebdfd47 100644
--- a/reference/sodium/functions/sodium-crypto-kdf-derive-from-key.xml
+++ b/reference/sodium/functions/sodium-crypto-kdf-derive-from-key.xml
@@ -13,7 +13,7 @@
    <methodparam><type>int</type><parameter>subkey_length</parameter></methodparam>
    <methodparam><type>int</type><parameter>subkey_id</parameter></methodparam>
    <methodparam><type>string</type><parameter>context</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Derive a subkey from a root key and additional context.
diff --git a/reference/sodium/functions/sodium-crypto-kx-client-session-keys.xml b/reference/sodium/functions/sodium-crypto-kx-client-session-keys.xml
index e23a4bfb711b..1b64ec44f709 100644
--- a/reference/sodium/functions/sodium-crypto-kx-client-session-keys.xml
+++ b/reference/sodium/functions/sodium-crypto-kx-client-session-keys.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>array</type><methodname>sodium_crypto_kx_client_session_keys</methodname>
-   <methodparam><type>string</type><parameter>client_key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>client_key_pair</parameter></methodparam>
    <methodparam><type>string</type><parameter>server_key</parameter></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-crypto-kx-publickey.xml b/reference/sodium/functions/sodium-crypto-kx-publickey.xml
index 60aeda40b50c..d63a10ce5781 100644
--- a/reference/sodium/functions/sodium-crypto-kx-publickey.xml
+++ b/reference/sodium/functions/sodium-crypto-kx-publickey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_kx_publickey</methodname>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Extract the public key from a crypto_kx keypair.
diff --git a/reference/sodium/functions/sodium-crypto-kx-secretkey.xml b/reference/sodium/functions/sodium-crypto-kx-secretkey.xml
index 6eaba4d3784d..c0e03597ff25 100644
--- a/reference/sodium/functions/sodium-crypto-kx-secretkey.xml
+++ b/reference/sodium/functions/sodium-crypto-kx-secretkey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_kx_secretkey</methodname>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Extract the secret key from a crypto_kx keypair.
diff --git a/reference/sodium/functions/sodium-crypto-kx-seed-keypair.xml b/reference/sodium/functions/sodium-crypto-kx-seed-keypair.xml
index 86ad9fccda40..ce7afbbe4f1a 100644
--- a/reference/sodium/functions/sodium-crypto-kx-seed-keypair.xml
+++ b/reference/sodium/functions/sodium-crypto-kx-seed-keypair.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_kx_seed_keypair</methodname>
-   <methodparam><type>string</type><parameter>seed</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>seed</parameter></methodparam>
   </methodsynopsis>
   <para>
 
diff --git a/reference/sodium/functions/sodium-crypto-kx-server-session-keys.xml b/reference/sodium/functions/sodium-crypto-kx-server-session-keys.xml
index 945922208517..60dd10305d24 100644
--- a/reference/sodium/functions/sodium-crypto-kx-server-session-keys.xml
+++ b/reference/sodium/functions/sodium-crypto-kx-server-session-keys.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>array</type><methodname>sodium_crypto_kx_server_session_keys</methodname>
-   <methodparam><type>string</type><parameter>server_key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>server_key_pair</parameter></methodparam>
    <methodparam><type>string</type><parameter>client_key</parameter></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str-verify.xml b/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str-verify.xml
index 24a66ba46105..03d9c4993b97 100644
--- a/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str-verify.xml
+++ b/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str-verify.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-pwhash-scryptsalsa208sha256-str-verify" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_pwhash_scryptsalsa208sha256_str_verify</refname>
@@ -12,7 +11,7 @@
   <methodsynopsis>
    <type>bool</type><methodname>sodium_crypto_pwhash_scryptsalsa208sha256_str_verify</methodname>
    <methodparam><type>string</type><parameter>hash</parameter></methodparam>
-   <methodparam><type>string</type><parameter>password</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>password</parameter></methodparam>
   </methodsynopsis>
   <para>
 
@@ -53,7 +52,6 @@
 
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str.xml b/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str.xml
index 8b5dc172049e..dd1bb48b437f 100644
--- a/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str.xml
+++ b/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256-str.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-pwhash-scryptsalsa208sha256-str" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_pwhash_scryptsalsa208sha256_str</refname>
@@ -11,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_pwhash_scryptsalsa208sha256_str</methodname>
-   <methodparam><type>string</type><parameter>password</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>password</parameter></methodparam>
    <methodparam><type>int</type><parameter>opslimit</parameter></methodparam>
    <methodparam><type>int</type><parameter>memlimit</parameter></methodparam>
   </methodsynopsis>
@@ -62,7 +61,6 @@
 
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256.xml b/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256.xml
index 3536476f501b..67fae398b2ff 100644
--- a/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256.xml
+++ b/reference/sodium/functions/sodium-crypto-pwhash-scryptsalsa208sha256.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-pwhash-scryptsalsa208sha256" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_pwhash_scryptsalsa208sha256</refname>
@@ -12,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_pwhash_scryptsalsa208sha256</methodname>
    <methodparam><type>int</type><parameter>length</parameter></methodparam>
-   <methodparam><type>string</type><parameter>password</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>password</parameter></methodparam>
    <methodparam><type>string</type><parameter>salt</parameter></methodparam>
    <methodparam><type>int</type><parameter>opslimit</parameter></methodparam>
    <methodparam><type>int</type><parameter>memlimit</parameter></methodparam>
@@ -82,7 +81,6 @@
 
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-pwhash-str-verify.xml b/reference/sodium/functions/sodium-crypto-pwhash-str-verify.xml
index 66b277395463..4c4f501e6873 100644
--- a/reference/sodium/functions/sodium-crypto-pwhash-str-verify.xml
+++ b/reference/sodium/functions/sodium-crypto-pwhash-str-verify.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-pwhash-str-verify" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_pwhash_str_verify</refname>
@@ -12,7 +11,7 @@
   <methodsynopsis>
    <type>bool</type><methodname>sodium_crypto_pwhash_str_verify</methodname>
    <methodparam><type>string</type><parameter>hash</parameter></methodparam>
-   <methodparam><type>string</type><parameter>password</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>password</parameter></methodparam>
   </methodsynopsis>
   <para>
    Checks that a password hash created using <function>sodium_crypto_pwhash_str</function> matches a given plain-text password. Note that the parameters are in the opposite order to the same parameters in the similar <function>password_verify</function> function.
@@ -71,7 +70,6 @@
  </refsect1>
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-pwhash-str.xml b/reference/sodium/functions/sodium-crypto-pwhash-str.xml
index d3642d20fac5..14a7c78732dd 100644
--- a/reference/sodium/functions/sodium-crypto-pwhash-str.xml
+++ b/reference/sodium/functions/sodium-crypto-pwhash-str.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_pwhash_str</methodname>
-   <methodparam><type>string</type><parameter>password</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>password</parameter></methodparam>
    <methodparam><type>int</type><parameter>opslimit</parameter></methodparam>
    <methodparam><type>int</type><parameter>memlimit</parameter></methodparam>
   </methodsynopsis>
diff --git a/reference/sodium/functions/sodium-crypto-pwhash.xml b/reference/sodium/functions/sodium-crypto-pwhash.xml
index 60c36fdcf99f..205c132f5f5c 100644
--- a/reference/sodium/functions/sodium-crypto-pwhash.xml
+++ b/reference/sodium/functions/sodium-crypto-pwhash.xml
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_pwhash</methodname>
    <methodparam><type>int</type><parameter>length</parameter></methodparam>
-   <methodparam><type>string</type><parameter>password</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>password</parameter></methodparam>
    <methodparam><type>string</type><parameter>salt</parameter></methodparam>
    <methodparam><type>int</type><parameter>opslimit</parameter></methodparam>
    <methodparam><type>int</type><parameter>memlimit</parameter></methodparam>
diff --git a/reference/sodium/functions/sodium-crypto-secretbox-open.xml b/reference/sodium/functions/sodium-crypto-secretbox-open.xml
index 79e24e307e49..99a2f51d67ba 100644
--- a/reference/sodium/functions/sodium-crypto-secretbox-open.xml
+++ b/reference/sodium/functions/sodium-crypto-secretbox-open.xml
@@ -12,7 +12,7 @@
    <type class="union"><type>string</type><type>false</type></type><methodname>sodium_crypto_secretbox_open</methodname>
    <methodparam><type>string</type><parameter>ciphertext</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Decrypt an encrypted message with a symmetric (shared) key.
diff --git a/reference/sodium/functions/sodium-crypto-secretbox.xml b/reference/sodium/functions/sodium-crypto-secretbox.xml
index 566bb621a979..de318ecd4672 100644
--- a/reference/sodium/functions/sodium-crypto-secretbox.xml
+++ b/reference/sodium/functions/sodium-crypto-secretbox.xml
@@ -10,9 +10,9 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_secretbox</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Encrypt a message with a symmetric (shared) key.
diff --git a/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-pull.xml b/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-pull.xml
index d50719941eb3..17decac0a3b8 100644
--- a/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-pull.xml
+++ b/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-pull.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-secretstream-xchacha20poly1305-init-pull" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_secretstream_xchacha20poly1305_init_pull</refname>
@@ -12,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_secretstream_xchacha20poly1305_init_pull</methodname>
    <methodparam><type>string</type><parameter>header</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Initialize a secretstream context for decryption.
@@ -101,7 +100,6 @@ string(12) "Hello world!"
   </example><!-- }}} -->
  </refsect1><!-- }}} -->
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-push.xml b/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-push.xml
index 9f9c426b04e0..4866798bab22 100644
--- a/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-push.xml
+++ b/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-init-push.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-secretstream-xchacha20poly1305-init-push" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_secretstream_xchacha20poly1305_init_push</refname>
@@ -11,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>array</type><methodname>sodium_crypto_secretstream_xchacha20poly1305_init_push</methodname>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Initialize a secretstream context for encryption.
@@ -92,7 +91,6 @@ string(106) "971e33b255f0990ef3931caf761c59136efa77b434832f28ec719e3ff73f5aec38b
  </refsect1><!-- }}} -->
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-push.xml b/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-push.xml
index 16103633e29a..9b51b41da9e7 100644
--- a/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-push.xml
+++ b/reference/sodium/functions/sodium-crypto-secretstream-xchacha20poly1305-push.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-secretstream-xchacha20poly1305-push">
+<refentry xml:id="function.sodium-crypto-secretstream-xchacha20poly1305-push" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_secretstream_xchacha20poly1305_push</refname>
   <refpurpose>Encrypt a chunk of data so that it can safely be decrypted in a streaming API</refpurpose>
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_secretstream_xchacha20poly1305_push</methodname>
    <methodparam><type>string</type><parameter role="reference">state</parameter></methodparam>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam choice="opt"><type>string</type><parameter>additional_data</parameter><initializer>""</initializer></methodparam>
    <methodparam choice="opt"><type>int</type><parameter>tag</parameter><initializer><constant>SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_MESSAGE</constant></initializer></methodparam>
   </methodsynopsis>
diff --git a/reference/sodium/functions/sodium-crypto-shorthash.xml b/reference/sodium/functions/sodium-crypto-shorthash.xml
index 1a060fcfe456..22532f54932b 100644
--- a/reference/sodium/functions/sodium-crypto-shorthash.xml
+++ b/reference/sodium/functions/sodium-crypto-shorthash.xml
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_shorthash</methodname>
    <methodparam><type>string</type><parameter>message</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    <function>sodium_crypto_shorthash</function> wraps a hash function called
diff --git a/reference/sodium/functions/sodium-crypto-sign-detached.xml b/reference/sodium/functions/sodium-crypto-sign-detached.xml
index 4c68f1994888..d1b83e46e118 100644
--- a/reference/sodium/functions/sodium-crypto-sign-detached.xml
+++ b/reference/sodium/functions/sodium-crypto-sign-detached.xml
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign_detached</methodname>
    <methodparam><type>string</type><parameter>message</parameter></methodparam>
-   <methodparam><type>string</type><parameter>secret_key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>secret_key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Sign a message with a secret key, that can be verified by the corresponding public key.
diff --git a/reference/sodium/functions/sodium-crypto-sign-ed25519-sk-to-curve25519.xml b/reference/sodium/functions/sodium-crypto-sign-ed25519-sk-to-curve25519.xml
index dff3499a5998..0b0dd7193969 100644
--- a/reference/sodium/functions/sodium-crypto-sign-ed25519-sk-to-curve25519.xml
+++ b/reference/sodium/functions/sodium-crypto-sign-ed25519-sk-to-curve25519.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-sign-ed25519-sk-to-curve25519">
+<refentry xml:id="function.sodium-crypto-sign-ed25519-sk-to-curve25519" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_sign_ed25519_sk_to_curve25519</refname>
   <refpurpose>Convert an Ed25519 secret key to a Curve25519 secret key</refpurpose>
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign_ed25519_sk_to_curve25519</methodname>
-   <methodparam><type>string</type><parameter>secret_key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>secret_key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Given an Ed25519 secret key, calculate the birationally equivalent X25519 secret key.
diff --git a/reference/sodium/functions/sodium-crypto-sign-keypair-from-secretkey-and-publickey.xml b/reference/sodium/functions/sodium-crypto-sign-keypair-from-secretkey-and-publickey.xml
index b7316fff0dbf..845a32fc1087 100644
--- a/reference/sodium/functions/sodium-crypto-sign-keypair-from-secretkey-and-publickey.xml
+++ b/reference/sodium/functions/sodium-crypto-sign-keypair-from-secretkey-and-publickey.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-sign-keypair-from-secretkey-and-publickey" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_sign_keypair_from_secretkey_and_publickey</refname>
@@ -11,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign_keypair_from_secretkey_and_publickey</methodname>
-   <methodparam><type>string</type><parameter>secret_key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>secret_key</parameter></methodparam>
    <methodparam><type>string</type><parameter>public_key</parameter></methodparam>
   </methodsynopsis>
   <para>
@@ -51,7 +50,6 @@
 
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-crypto-sign-publickey-from-secretkey.xml b/reference/sodium/functions/sodium-crypto-sign-publickey-from-secretkey.xml
index c10e688ecc47..54d0cebc4d04 100644
--- a/reference/sodium/functions/sodium-crypto-sign-publickey-from-secretkey.xml
+++ b/reference/sodium/functions/sodium-crypto-sign-publickey-from-secretkey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign_publickey_from_secretkey</methodname>
-   <methodparam><type>string</type><parameter>secret_key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>secret_key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Extract the Ed25519 public key from the secret key
diff --git a/reference/sodium/functions/sodium-crypto-sign-publickey.xml b/reference/sodium/functions/sodium-crypto-sign-publickey.xml
index 15b78385d7e6..4520278b7ebf 100644
--- a/reference/sodium/functions/sodium-crypto-sign-publickey.xml
+++ b/reference/sodium/functions/sodium-crypto-sign-publickey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign_publickey</methodname>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Extract the Ed25519 public key from a keypair
diff --git a/reference/sodium/functions/sodium-crypto-sign-secretkey.xml b/reference/sodium/functions/sodium-crypto-sign-secretkey.xml
index dd19d9bcdc73..4a8e40cd721b 100644
--- a/reference/sodium/functions/sodium-crypto-sign-secretkey.xml
+++ b/reference/sodium/functions/sodium-crypto-sign-secretkey.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign_secretkey</methodname>
-   <methodparam><type>string</type><parameter>key_pair</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key_pair</parameter></methodparam>
   </methodsynopsis>
   <para>
    Extract the Ed25519 secret key from a keypair
diff --git a/reference/sodium/functions/sodium-crypto-sign-seed-keypair.xml b/reference/sodium/functions/sodium-crypto-sign-seed-keypair.xml
index 5bb9c8c84279..553c1eea612c 100644
--- a/reference/sodium/functions/sodium-crypto-sign-seed-keypair.xml
+++ b/reference/sodium/functions/sodium-crypto-sign-seed-keypair.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign_seed_keypair</methodname>
-   <methodparam><type>string</type><parameter>seed</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>seed</parameter></methodparam>
   </methodsynopsis>
   <para>
    Clamps the seed to form a secret key, derives the public key, and returns the two as a keypair.
diff --git a/reference/sodium/functions/sodium-crypto-sign.xml b/reference/sodium/functions/sodium-crypto-sign.xml
index 099125059a49..9bd7c301a81d 100644
--- a/reference/sodium/functions/sodium-crypto-sign.xml
+++ b/reference/sodium/functions/sodium-crypto-sign.xml
@@ -11,7 +11,7 @@
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_sign</methodname>
    <methodparam><type>string</type><parameter>message</parameter></methodparam>
-   <methodparam><type>string</type><parameter>secret_key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>secret_key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Sign a message with a secret key, that can be verified by the corresponding public key.
diff --git a/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor-ic.xml b/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor-ic.xml
index 58d823b1519f..57cdb3dcd98b 100644
--- a/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor-ic.xml
+++ b/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor-ic.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-crypto-stream-xchacha20-xor-ic">
+<refentry xml:id="function.sodium-crypto-stream-xchacha20-xor-ic" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_stream_xchacha20_xor_ic</refname>
   <refpurpose>Encrypts a message using a nonce and a secret key (no authentication)</refpurpose>
@@ -9,10 +9,10 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_stream_xchacha20_xor_ic</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
    <methodparam><type>int</type><parameter>counter</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    The function is similar to <function>sodium_crypto_stream_xchacha20_xor</function>
diff --git a/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor.xml b/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor.xml
index e8729184b4fd..fe13e06ae178 100644
--- a/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor.xml
+++ b/reference/sodium/functions/sodium-crypto-stream-xchacha20-xor.xml
@@ -9,9 +9,9 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_stream_xchacha20_xor</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Encrypts a <parameter>message</parameter> using a <parameter>nonce</parameter>
diff --git a/reference/sodium/functions/sodium-crypto-stream-xchacha20.xml b/reference/sodium/functions/sodium-crypto-stream-xchacha20.xml
index fb420cacc64a..629d6deaa60e 100644
--- a/reference/sodium/functions/sodium-crypto-stream-xchacha20.xml
+++ b/reference/sodium/functions/sodium-crypto-stream-xchacha20.xml
@@ -11,7 +11,7 @@
    <type>string</type><methodname>sodium_crypto_stream_xchacha20</methodname>
    <methodparam><type>int</type><parameter>length</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Expands the <parameter>key</parameter> and <parameter>nonce</parameter> into a keystream of pseudorandom bytes.
diff --git a/reference/sodium/functions/sodium-crypto-stream-xor.xml b/reference/sodium/functions/sodium-crypto-stream-xor.xml
index f42ac2cc6865..5f9c074b965c 100644
--- a/reference/sodium/functions/sodium-crypto-stream-xor.xml
+++ b/reference/sodium/functions/sodium-crypto-stream-xor.xml
@@ -10,9 +10,9 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_crypto_stream_xor</methodname>
-   <methodparam><type>string</type><parameter>message</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>message</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    This function encrypts a message with XSalsa20, but does not provide any ciphertext
diff --git a/reference/sodium/functions/sodium-crypto-stream.xml b/reference/sodium/functions/sodium-crypto-stream.xml
index ced8bac7ce8d..e59a7b682b1e 100644
--- a/reference/sodium/functions/sodium-crypto-stream.xml
+++ b/reference/sodium/functions/sodium-crypto-stream.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-
 <refentry xml:id="function.sodium-crypto-stream" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_crypto_stream</refname>
@@ -13,7 +12,7 @@
    <type>string</type><methodname>sodium_crypto_stream</methodname>
    <methodparam><type>int</type><parameter>length</parameter></methodparam>
    <methodparam><type>string</type><parameter>nonce</parameter></methodparam>
-   <methodparam><type>string</type><parameter>key</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>key</parameter></methodparam>
   </methodsynopsis>
   <para>
    Generate a deterministic sequence of bytes from a seed, using the XSalsa20 stream cipher.
@@ -61,7 +60,6 @@
 
 
 </refentry>
-
 <!-- Keep this comment at the end of the file
 Local variables:
 mode: sgml
diff --git a/reference/sodium/functions/sodium-hex2bin.xml b/reference/sodium/functions/sodium-hex2bin.xml
index b371ae8618b9..abf533580198 100644
--- a/reference/sodium/functions/sodium-hex2bin.xml
+++ b/reference/sodium/functions/sodium-hex2bin.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!-- $Revision$ -->
-<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.sodium-hex2bin">
+<refentry xml:id="function.sodium-hex2bin" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink">
  <refnamediv>
   <refname>sodium_hex2bin</refname>
   <refpurpose>Decodes a hexadecimally encoded binary string</refpurpose>
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_hex2bin</methodname>
-   <methodparam><type>string</type><parameter>string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string</parameter></methodparam>
    <methodparam choice="opt"><type>string</type><parameter>ignore</parameter><initializer>""</initializer></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-memcmp.xml b/reference/sodium/functions/sodium-memcmp.xml
index 94ba39e8b4fe..e84a6a8ae58e 100644
--- a/reference/sodium/functions/sodium-memcmp.xml
+++ b/reference/sodium/functions/sodium-memcmp.xml
@@ -10,8 +10,8 @@
   &reftitle.description;
   <methodsynopsis>
    <type>int</type><methodname>sodium_memcmp</methodname>
-   <methodparam><type>string</type><parameter>string1</parameter></methodparam>
-   <methodparam><type>string</type><parameter>string2</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string1</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string2</parameter></methodparam>
   </methodsynopsis>
   <para>
    Compare two strings in constant-time.
diff --git a/reference/sodium/functions/sodium-memzero.xml b/reference/sodium/functions/sodium-memzero.xml
index e75c6fa9ef01..3a953b7caf8f 100644
--- a/reference/sodium/functions/sodium-memzero.xml
+++ b/reference/sodium/functions/sodium-memzero.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>void</type><methodname>sodium_memzero</methodname>
-   <methodparam><type>string</type><parameter role="reference">string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter role="reference">string</parameter></methodparam>
   </methodsynopsis>
   <para>
    <function>sodium_memzero</function> zeroes out the string that is passed by reference.
diff --git a/reference/sodium/functions/sodium-pad.xml b/reference/sodium/functions/sodium-pad.xml
index eb46faa6f53f..f1c7b091fefc 100644
--- a/reference/sodium/functions/sodium-pad.xml
+++ b/reference/sodium/functions/sodium-pad.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_pad</methodname>
-   <methodparam><type>string</type><parameter>string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string</parameter></methodparam>
    <methodparam><type>int</type><parameter>block_size</parameter></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/sodium/functions/sodium-unpad.xml b/reference/sodium/functions/sodium-unpad.xml
index 7c2cad677f2a..0f0188741f47 100644
--- a/reference/sodium/functions/sodium-unpad.xml
+++ b/reference/sodium/functions/sodium-unpad.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>sodium_unpad</methodname>
-   <methodparam><type>string</type><parameter>string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string</parameter></methodparam>
    <methodparam><type>int</type><parameter>block_size</parameter></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/strings/functions/crypt.xml b/reference/strings/functions/crypt.xml
index 86c9db189bbf..f96bbdb62c6d 100644
--- a/reference/strings/functions/crypt.xml
+++ b/reference/strings/functions/crypt.xml
@@ -14,7 +14,7 @@
   &reftitle.description;
   <methodsynopsis>
    <type>string</type><methodname>crypt</methodname>
-   <methodparam><type>string</type><parameter>string</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>string</parameter></methodparam>
    <methodparam><type>string</type><parameter>salt</parameter></methodparam>
   </methodsynopsis>
   <para>
diff --git a/reference/zip/ziparchive/setencryptionindex.xml b/reference/zip/ziparchive/setencryptionindex.xml
index 5bdf2f3a238a..1f75a83d3fa8 100644
--- a/reference/zip/ziparchive/setencryptionindex.xml
+++ b/reference/zip/ziparchive/setencryptionindex.xml
@@ -12,7 +12,7 @@
    <modifier>public</modifier> <type>bool</type><methodname>ZipArchive::setEncryptionIndex</methodname>
    <methodparam><type>int</type><parameter>index</parameter></methodparam>
    <methodparam><type>int</type><parameter>method</parameter></methodparam>
-   <methodparam choice="opt"><type class="union"><type>string</type><type>null</type></type><parameter>password</parameter><initializer>&null;</initializer></methodparam>
+   <methodparam choice="opt"><modifier role="attribute">#[\SensitiveParameter]</modifier><type class="union"><type>string</type><type>null</type></type><parameter>password</parameter><initializer>&null;</initializer></methodparam>
   </methodsynopsis>
   <para>
    Set the encryption method of an entry defined by its index.
diff --git a/reference/zip/ziparchive/setencryptionname.xml b/reference/zip/ziparchive/setencryptionname.xml
index c9da51ce4f76..2334a8aa3df6 100644
--- a/reference/zip/ziparchive/setencryptionname.xml
+++ b/reference/zip/ziparchive/setencryptionname.xml
@@ -11,7 +11,7 @@
    <modifier>public</modifier> <type>bool</type><methodname>ZipArchive::setEncryptionName</methodname>
    <methodparam><type>string</type><parameter>name</parameter></methodparam>
    <methodparam><type>int</type><parameter>method</parameter></methodparam>
-   <methodparam choice="opt"><type class="union"><type>string</type><type>null</type></type><parameter>password</parameter><initializer>&null;</initializer></methodparam>
+   <methodparam choice="opt"><modifier role="attribute">#[\SensitiveParameter]</modifier><type class="union"><type>string</type><type>null</type></type><parameter>password</parameter><initializer>&null;</initializer></methodparam>
   </methodsynopsis>
   <para>
    Set the encryption method of an entry defined by its name.
diff --git a/reference/zip/ziparchive/setpassword.xml b/reference/zip/ziparchive/setpassword.xml
index de8379aa9775..cfc7525eb848 100644
--- a/reference/zip/ziparchive/setpassword.xml
+++ b/reference/zip/ziparchive/setpassword.xml
@@ -10,7 +10,7 @@
   &reftitle.description;
   <methodsynopsis role="ZipArchive">
    <modifier>public</modifier> <type>bool</type><methodname>ZipArchive::setPassword</methodname>
-   <methodparam><type>string</type><parameter>password</parameter></methodparam>
+   <methodparam><modifier role="attribute">#[\SensitiveParameter]</modifier><type>string</type><parameter>password</parameter></methodparam>
   </methodsynopsis>
   <para>
    Sets the password for the active archive.