Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Blazor.ZeroStorage/Blazor.ZeroStorage.csproj
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<PackageId>Blazor.ZeroStorage</PackageId>
<Title>Blazor.ZeroStorage</Title>
<Description>A secure, zero-storage, zero-knowledge encrypted storage solution for Blazor applications.</Description>
<Version>1.0.1</Version>
<Version>1.0.2</Version>

<PackageReadmeFile>README.md</PackageReadmeFile>
<PackageLicenseFile>LICENSE</PackageLicenseFile>
Expand Down
10 changes: 5 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@ A secure, zero-storage, zero-knowledge encrypted storage solution for Blazor app
- **Stateless**: The library holds no persistent state. Once ZeroStorage is locked or the browser tab closes, the key is wiped from memory.
---
- **Authenticated Encryption**: Utilizes [AES-GCM](https://en.wikipedia.org/wiki/Galois/Counter_Mode) with 256-bit keys, guaranteeing both data confidentiality and integrity.
- **Hardware-Bound Entropy**: Utilizes the [WebAuthn](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) [PRF](https://en.wikipedia.org/wiki/Pseudorandom_function_family) (Pseudo-Random Function) extension to extract cryptographically secure 256-bit encryption keys directly from the user's hardware passkey.
- **Per-Item Key Derivation**: Uses [HKDF](https://en.wikipedia.org/wiki/HKDF) (HMAC-based Extract-and-Expand Key Derivation Function) to generate a unique encryption key for every single record, isolating any potential compromise to a single item.
- **Cryptographic Blinding**: Database lookup keys are deterministically hashed via [HMAC](https://en.wikipedia.org/wiki/HMAC) (Hash-based Message Authentication Code), making it impossible for an attacker to read logical keys or infer relationships between records.
- **Metadata Obfuscation**: Supports uniform cryptographic padding to mask the true byte-size of payloads, preventing attackers from guessing content based on payload length.
- **Stateless Recovery**: Allows exporting the raw encryption key as a typo-resistant [Base58](https://en.wikipedia.org/wiki/Base58) string. This enables complete recovery without storing any fallback mechanisms or backup hashes in the database.
- **Cryptographic Blinding**: Database lookup keys are deterministically hashed via [Hash-based Message Authentication Code (HMAC)](https://en.wikipedia.org/wiki/HMAC), making it impossible for an attacker to read logical keys or infer relationships between records.
- **Cryptographic Sandboxing (Multi-User)**: Supports multiple users on the same device. Lookup keys are derived from the user's specific key, so a user's data exists in a mathematically isolated, invisible partition.
- **Hardware-Bound Entropy**: Utilizes the [WebAuthn](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) [Pseudo-Random Function (PRF)](https://en.wikipedia.org/wiki/Pseudorandom_function_family) extension to extract cryptographically secure 256-bit encryption keys directly from the user's hardware passkey.
- **Metadata Obfuscation**: Supports uniform cryptographic padding to mask the true byte-size of payloads, preventing attackers from guessing content based on payload length.
- **Per-Item Key Derivation**: Uses [HMAC-based Extract-and-Expand Key Derivation Function (HKDF)](https://en.wikipedia.org/wiki/HKDF) to generate a unique encryption key for every single record, isolating any potential compromise to a single item.
- **Same-Origin Isolation**: Built on top of the browser's native [IndexedDB](https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API), guaranteeing that the encrypted data is inaccessible to other domains or websites.
- **Stateless Recovery**: Allows exporting the raw encryption key as a typo-resistant [Base58](https://en.wikipedia.org/wiki/Base58) string. This enables complete recovery without storing any fallback mechanisms or backup hashes in the database.

## Installation

Expand Down
File renamed without changes.
2 changes: 1 addition & 1 deletion docs/ZeroStorage/ZeroStorage.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ public sealed class ZeroStorage : IAsyncDisposable
| [SetAsync\<T\>(string, T, CancellationToken)](/docs/ZeroStorage/SetAsync.md) | Stores a value associated with the specified key. |
| [GetAsync\<T\>(string, CancellationToken)](/docs/ZeroStorage/GetAsync.md) | Retrieves a value associated with the specified key. |
| [DeleteAsync(string, CancellationToken)](/docs/ZeroStorage/DeleteAsync.md) | Deletes the value associated with the specified key. |
| [DisposeAsync()](/docs/ZeroStorage/DisposeAsync.md) | Disposes the by locking and releasing any resources. |
| [DisposeAsync()](/docs/ZeroStorage/DisposeAsync.md) | Disposes the [ZeroStorage](/docs/ZeroStorage/ZeroStorage.md) instance by locking and releasing any resources. |

## Events

Expand Down