Rhea

Cryptography

What is encrypted, with what, and what that binding actually guarantees.

Rhea cannot decrypt protected customer content without customer-controlled cryptographic authority.

Content encryption

AES-256-GCM, applied on the device.

  • File contents are encrypted in the browser before any byte reaches connected storage.
  • Content is processed in 5 MB chunks, each with its own random 96-bit initialization vector.
  • Each chunk is cryptographically bound to its document, encryption generation and position.
  • Reordering, splicing, duplicating or substituting chunks in the bucket is detected on open.

Manifests

The chunk list is authenticated, and cannot be downgraded.

A document's manifest describes its chunks. The manifest is authenticated with a key derived from the document's own key, so it cannot be rewritten by anyone who only holds storage access.

The server enforces a floor on manifest authentication: a document that has been authenticated cannot be served back as an unauthenticated read. Downgrade is not a path.

Key custody

Where each key lives.

Where each key lives.
Key materialWhere it existsWho can use it
Document data encryption keyGenerated on the device, stored wrappedAuthorized members of the document
Wallet-derived key-encryption keyDerived on the deviceThe member, on their device
Manifest authentication keyDerived from the document keyWhoever can already open the document
Guardian shares and Recovery KitsHeld by guardians, outside RheaA configured threshold of guardians
Storage provider credentialsStored server-side, decryptable by RheaRhea's backend, to operate your connection

An Owner or Admin role does not grant the ability to decrypt another member's document. Administrative authority and decrypt authority are separate.

Boundaries

What cryptography does not solve.

  • Plaintext after an authorized decryption is outside RED's control.
  • A compromised authorized endpoint can read what that endpoint is authorized to read.
  • Filenames, folder names and MIME types are plaintext metadata today.
  • Rhea serves the client application, which is the standard web-delivery trust boundary.
  • No independent third-party cryptographic audit has been completed yet.

See it against your own environment.

Connect your own storage, protect a document, and read the recorded evidence yourself.