Cryptography
What is encrypted, with what, and what that binding actually guarantees.
Rhea cannot decrypt protected customer content without customer-controlled cryptographic authority.
Content encryption
AES-256-GCM, applied on the device.
- File contents are encrypted in the browser before any byte reaches connected storage.
- Content is processed in 5 MB chunks, each with its own random 96-bit initialization vector.
- Each chunk is cryptographically bound to its document, encryption generation and position.
- Reordering, splicing, duplicating or substituting chunks in the bucket is detected on open.
Manifests
The chunk list is authenticated, and cannot be downgraded.
A document's manifest describes its chunks. The manifest is authenticated with a key derived from the document's own key, so it cannot be rewritten by anyone who only holds storage access.
The server enforces a floor on manifest authentication: a document that has been authenticated cannot be served back as an unauthenticated read. Downgrade is not a path.
Key custody
Where each key lives.
Document data encryption key
- Where it exists
- Generated on the device, stored wrapped
- Who can use it
- Authorized members of the document
Wallet-derived key-encryption key
- Where it exists
- Derived on the device
- Who can use it
- The member, on their device
Manifest authentication key
- Where it exists
- Derived from the document key
- Who can use it
- Whoever can already open the document
Guardian shares and Recovery Kits
- Where it exists
- Held by guardians, outside Rhea
- Who can use it
- A configured threshold of guardians
Storage provider credentials
- Where it exists
- Stored server-side, decryptable by Rhea
- Who can use it
- Rhea's backend, to operate your connection
| Key material | Where it exists | Who can use it |
|---|---|---|
| Document data encryption key | Generated on the device, stored wrapped | Authorized members of the document |
| Wallet-derived key-encryption key | Derived on the device | The member, on their device |
| Manifest authentication key | Derived from the document key | Whoever can already open the document |
| Guardian shares and Recovery Kits | Held by guardians, outside Rhea | A configured threshold of guardians |
| Storage provider credentials | Stored server-side, decryptable by Rhea | Rhea's backend, to operate your connection |
An Owner or Admin role does not grant the ability to decrypt another member's document. Administrative authority and decrypt authority are separate.
Boundaries
What cryptography does not solve.
- Plaintext after an authorized decryption is outside RED's control.
- A compromised authorized endpoint can read what that endpoint is authorized to read.
- Filenames, folder names and MIME types are plaintext metadata today.
- Rhea serves the client application, which is the standard web-delivery trust boundary.
- No independent third-party cryptographic audit has been completed yet.
Start inside RED.
Explore RED, connect supported customer-owned storage and work through a document workflow. Review permissions and recorded activity in the same environment.