eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: replace private cas envelope

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 23:02:59 +02:00
commit 63ea36bb51
10 changed files with 193 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/architecture.md
View file

@ -478,6 +478,10 @@ The project is structured for future multi-user local-first authorization:
## Keyhive/BeeKEM Roadmap
Resource secret epochs are the v0/v1 approximation for private payload access.
Private CAS writes use an AES-256-GCM envelope keyed from the resource, local
secret id, and epoch with resource-bound associated data and random nonces.
Prototype BLAKE3-XOR private blob envelopes from earlier pre-deployment builds
are rejected and should be recreated from plaintext.
Later designs can add Keyhive-like convergent capabilities and BeeKEM/CGKA-style
group key evolution. The bootstrap does not implement BeeKEM and does not claim
strong forward secrecy or post-compromise security.