Account key (UMK)
The UMK is 96 bytes: 32-byte X25519 secret ‖ 64-byte ML-KEM-768 seed (d‖z).
Recovery phrases are normalized (NFKD, lowercased, whitespace-collapsed) before the KDF in every binding — a phrase typed with stray newlines still opens its blob.
File keys (DEK) and envelopes
A DEK is 32 bytes. Envelopes bind it to an account key; wire format v2 is HPKE RFC 9180 mode PSK.
Every unwrap dispatches on the envelope’s
v field: v: 2 → HPKE v2, absent → legacy v1. Both wire formats carry wrappedDek as ct‖tag (48 bytes decoded).
Envelope JSON (v2): { v: 2, scheme: "evb-e2ee-file-wrap-hpke-psk-v1", kemId: 32, kdfId: 1, aeadId: 3, ephPublicX25519, kemCiphertext, wrappedDek } — no transported nonce; the base nonce is derived from the HPKE key schedule.
Content (EVB1)
Streaming variants buffer at most one 64 KiB chunk in memory; DEK material is zeroized on drop.
Names (metadata encryption)
Sharing wraps
Link keys and invitation key shares travel only in URL fragments (
#k=…, #iks=…) — the Everabyte backend never receives them. The same pattern applies to your own integration: a symmetric key you generate client-side makes a share readable without exposing your account key.
Frozen test vectors
evb-e2ee-v1.json (20 vectors: EVB1 content edges ×9, DEK envelope v1 + HPKE v2, mnemonic Argon2id v3 + PBKDF2 v2, device wrap, name alias + encrypted name, link + invite wraps, primitives) is consumed by the test suites of every binding. A binding that does not open the grid is not Everabyte-compatible; run the suites when you upgrade.