System Overview

Blindflare is a client-first protocol for building zero-trust encrypted web systems. It treats the server and network as untrusted couriers while the client retains custody over keys, cryptography, and validation.

Architecture

• Client: Generates keys, encrypts/decrypts data, signs/verifies blobs, derives per-request session keys, enforces policy.
• Server: Stores opaque content-addressed blobs and relays encrypted requests and responses. It cannot read or forge data.
• Transport: TLS is used for delivery; payloads remain encrypted end-to-end above the transport layer.

Data Model

• Content-addressed storage: Each encrypted blob is referenced by a hash of its ciphertext or manifest.
• Signed manifests: Blobs include signatures binding metadata to content, enabling offline verification.
• Minimal metadata: Only what's strictly necessary is exposed; avoid identifiers that can link users or documents.

Authentication

• Key-based identity: A public key represents the user. The private key never leaves the device.
• Verifier, not password: Registration publishes the public key and a verifier derived from the private key or a password-derived key. No plaintext passwords are transmitted or stored.
• Challenge/response: Requests are authenticated by signatures and possession of the private key.

Session and Transport Security

• ECDH key agreement: Each request derives a fresh symmetric key from ECDH using ephemeral or static-ephemeral keys.
• AEAD encryption: Authenticated encryption protects confidentiality and integrity with nonces and associated data.
• Replay protection: Nonces and counters prevent replays. Signatures bind request parameters.

Threat Model

• Compromised servers and proxies learn only ciphertexts and public information.
• Man-in-the-middle on the transport cannot decrypt the application payloads.
• Database dumps yield no secrets; keys and plaintext reside only on devices.
• Tampering is detected by signatures; forged data is rejected client-side.

On Proxies and Mass Surveillance

Historically, centralized network points have been leveraged for broad interception. The AT&T facility known as “Room 641A” was alleged to enable upstream collection of large volumes of Internet traffic. Modern reverse proxies and CDNs can occupy a similar vantage point on today’s web.

Blindflare treats such points as potentially adversarial: even where TLS terminates at a proxy, application payloads remain encrypted end-to-end above transport. This design denies proxies the plaintext needed for content inspection, profiling, or mass collection, limiting their role to delivery and caching of opaque ciphertext.

Key Management

• Keypairs: secp256k1 for signatures and ECDH.
• Derivation: Passwords may derive keys using a memory-hard KDF; random mnemonics can seed keys for stronger security.
• Recovery: Users back up mnemonic/private key; servers cannot assist beyond storing encrypted blobs.

Implementation Notes

• All cryptography runs locally with constant-time primitives.
• Prefer deterministic signatures and domain separation for KDFs.
• Version manifests to enable safe upgrades without breaking verification.

Back to Home | FAQ | Legal