Private drives have a global drive key, D, and multiple file keys F, for encryption. This enables a drive to have as many uniquely encrypted files as needed. One key is used for all versions of a single file (since new file versions use the same File-Id)
D is used for encrypting both Drive and Folder metadata whereas F is used for encrypting File metadata and the actual stored data. Having these different keys, D and F, allows a user to share specific files without revealing the contents of their entire drive.
D is derived using HKDF-SHA256 with an unsalted RSA-PSS signature of the drive's id and a user provided password.
F is also derived using HKDF-SHA256 with the drive key and the file's id.
Drive and File Key Derivation Diagram
Other wallets (like ArConnect) integrate with this Key Derivation protocol just exposing an API to collect a signature from a given Arweave wallet in order to get the SHA-256 signature needed for the HKDF to derive the Drive key.
A reference implementation, using Dart is available here, with a Typescript implementation available here
Comments
0 comments
Please sign in to leave a comment.