Zero-Knowledge End-to-End Encrypted File Sharing

Zero-Knowledge Architecture

In a zero-knowledge End-to-End Encrypted (E2EE) system, files are encrypted on the sender's device before any data leaves the browser sandbox. The application backend, database servers, and cloud storage providers process only encrypted binary blobs (`ciphertext`).

Client-Side Key Derivation (PBKDF2 & AES-256-GCM)

To generate symmetric encryption keys without transferring passphrases over network connections:

• PBKDF2 Key Derivation: Converts a user PIN and random salt into a cryptographic 256-bit key using 100,000+ iterations.
• AES-GCM Encryption: Encrypts data chunks using Galois/Counter Mode, providing both confidentiality and built-in cryptographic authentication tags.
• Initialization Vectors (IV): A unique 96-bit IV is generated for every binary payload.

WebRTC Peer-to-Peer vs Ephemeral Vault Storage

When sender and receiver are connected on the same local network or active browser session, data streams directly over WebRTC DataChannels. For asynchronous transfers, encrypted payloads reside in auto-expiring Cloudflare R2 vaults and self-destruct upon expiration.