Zero-Knowledge Architecture

Enver’s core principle: the server is a blind courier. It moves bytes it cannot read.

How it works

Encryption (ev push)

Your .env content
      │
      ▼
  Generate random 256-bit master key
      │
      ▼
  Split key → 5 Shamir shares (threshold: 3)
      │
  Derive AES key from lock key via PBKDF2
  (100,000 iterations, SHA-256)
      │
      ▼
  AES-256-GCM encrypt .env content
      │
  ┌───▼────────────────────────────┐
  │  Upload to server:             │
  │  • ciphertext (encrypted .env) │
  │  • iv + salt                   │
  │  • 5 Shamir key shares         │
  └────────────────────────────────┘
  Server stores all of the above.
  Server does NOT have your lock key.
  Server CANNOT decrypt.

Decryption (ev pull)

  ┌────────────────────────────────┐
  │  Download from server:         │
  │  • ciphertext                  │
  │  • iv + salt                   │
  │  • 5 Shamir key shares         │
  └───────────────────────────────┘
            │
            ▼
  Reconstruct master key from 3 of 5 shares
  (Shamir's Secret Sharing — locally)
            │
  Derive AES key from your lock key + salt
  (PBKDF2 — locally)
            │
            ▼
  AES-256-GCM decrypt → .env content
  (locally — plaintext never leaves your machine)

A single encrypted key is still a single point of failure. By splitting the key into 5 shares with a threshold of 3:

Any 3 shares are sufficient to reconstruct the key
No single share reveals anything about the key
Even if an attacker steals 2 shares from the server, they gain nothing

Algorithms used

Purpose	Algorithm
Symmetric encryption	AES-256-GCM
Key derivation	PBKDF2 (SHA-256, 100,000 iterations)
Secret splitting	Shamir’s Secret Sharing (5 shares, threshold 3)
Token hashing	SHA-256

⌘I