Ackaia One Crypto Engine

Source-available client-side encryption engine used by Ackaia One.

This repository exists to make the Ackaia One zero-knowledge encryption model inspectable. It contains the browser-side cryptographic engine responsible for master keys, file keys, encrypted metadata, chunk encryption, and public share key handling.

What this proves

Ackaia One encrypts sensitive file material in the client before upload:

• file contents are encrypted in the browser;
• file names are encrypted in the browser;
• file keys are generated in the browser;
• the user's vault secret is never sent to Ackaia servers;
• Ackaia servers store encrypted blobs and encrypted key material only.

What this does not claim

Zero-knowledge does not mean the local device is magically safe. If the browser, page runtime, extension environment, or operating system is compromised, local key material can be exposed. Ackaia One may persist the master key in IndexedDB for usability. That keeps Ackaia servers zero-knowledge, but it makes the user's browser a trusted local key store until the local key is cleared.

Install / use from source

git clone https://github.com/ackaiacorp/ackaia-one-crypto-engine.git
cd ackaia-one-crypto-engine
npm test

The package is ESM-only and has no runtime dependencies for the core engine. Vue is only needed if you use the optional compatibility adapter.

Basic usage

import { createAckaiaOneCryptoEngine } from '@ackaia/one-crypto-engine';

const crypto = createAckaiaOneCryptoEngine();

const { key: masterKey, exportedKey } = await crypto.generateMasterKey();
const wrapped = await crypto.wrapMasterKey(masterKey, 'correct horse battery staple');

const fileKey = await crypto.generateFileKey();
const wrappedFileKey = await crypto.wrapFileKey(fileKey, masterKey);

const encryptedName = await crypto.encryptMetadata('contract.pdf', fileKey);
const decryptedName = await crypto.decryptMetadata(encryptedName, fileKey);

Vue compatibility adapter

For the existing Laravel + Vue/Inertia application, import the adapter:

import { useStorageCrypto } from '@ackaia/one-crypto-engine/vue';

const {
  generateMasterKey,
  encryptMetadata,
  encryptChunk,
  decryptChunk,
  saveKeyToDevice,
} = useStorageCrypto();

The adapter keeps the old composable-style API while delegating all crypto work to audited classes.

Architecture

src/
  core/                  encoding, canonical JSON, errors
  crypto/                WebCrypto provider and crypto primitives
  storage/               browser key persistence
  adapters/vue.js        optional Vue compatibility layer
  engine.js              public facade
  protocol.js            public protocol constants

Core classes:

• WebCryptoProvider — runtime boundary for crypto.subtle and random bytes.
• AesGcmCipher — AES-GCM with protocol-bound AAD and legacy fallback.
• VaultKdf — PBKDF2-HMAC-SHA256 key derivation.
• MasterKeyVault — master key generation, wrap, and unwrap.
• MetadataCrypto — encrypted file/folder names.
• FileKeyCrypto — per-file key generation and wrapping.
• ChunkCrypto — chunk IV derivation and encrypted chunk operations.
• IndexedDbKeyStore — local browser persistence for UX.
• AckaiaOneCryptoEngine — stable public facade.

Protocol highlights

• AES-GCM-256.
• 96-bit IVs.
• 128-bit authentication tags.
• PBKDF2-HMAC-SHA256 with 600,000 iterations for new vault wraps.
• Legacy unwrap fallback for 100,000-iteration vaults.
• Chunk IV format: 64-bit random file nonce + 32-bit big-endian part number.
• New ciphertexts use Additional Authenticated Data (AAD).
• Legacy ciphertext fallback is retained so existing user data remains readable.

See docs/protocol.md for more details.

Visible metadata

Client-side encryption does not hide all metadata. Ackaia servers may still see account identity, object IDs, object type, encrypted object size, upload/download times, transfer usage, folder relationship IDs, sharing status, and operational security events. See docs/metadata-leakage.md.

License

This repository is source-available, not open source. See LICENSE.md.