Key management and e2e encryption

[jchris]

Overview of the e2e encryption system. (0.19)

• e2e is just for the storage files - the current implementation is designed so the storage bucket admin cannot read files alone, they must have metadata access.
• Each ledger uses a symmetric key, which is included in the metadata by default. This is optional and enterprises can use their existing key systems.
• The key system is fully upgradable to double ratchet with key based identity (like signal, matrix, etc) which is in our sights.
• Oauth: The short term goal is enterprise interop via oauth etc.
• UCAN: we've been prototyping self-sovereign auth which can be used to bring signatures to every document update.

[jchris]

Check out these notes on browser key storage https://digest.browsertech.com/archive/browsertech-digest-encrypting-offline-storage-for/?ref=localfirstnews.com

[jchris]

A good place to get into Fireproof's existing crypto: https://github.com/fireproof-storage/fireproof/blob/main/src/runtime/keyed-crypto.ts