Key hierarchy

Root vault keys, per-record data keys, device envelopes, Recovery Kits, and why envelope encryption makes rotation practical.

Recovery secret ──KDF──▶ Recovery wrapping key ─┐
                                                 ├──unwrap──▶ Root vault key
Device private key + ephemeral public key ───────┘                    │
                                                                       ▼
                                                         unwrap record data key
                                                                       │
                                                                       ▼
                                                              decrypt record

Root vault key

The browser generates one random root key per vault. Plain root-key bytes never enter the application server, database adapter, transport, logs, or Recovery Kit file. The active engine keeps them only while the vault is unlocked.

Record data keys

Every record gets a fresh random data-encryption key and nonce. That key encrypts record content; the root key wraps the data key. Root rotation can therefore rewrap keys without decrypting and re-encrypting every content payload.

Device keys

Each enrolled browser has independent X25519 key material. The server stores the public key and a device-specific encrypted root-key envelope. Revoking a device prevents future coordination but cannot erase keys already copied from a compromised device.

Recovery wrapping key

Argon2id derives a wrapping key from the Recovery Kit password or generated code and a random salt. The kit contains KDF parameters and an authenticated encrypted root key, never the recovery secret. See the cryptographic ADR for exact algorithms and parameters.

Rotation consequences

Root rotation creates a new root key, rewraps record data keys, replaces active device envelopes, and requires a newly verified Recovery Kit. Old root-key material remains only for the resumable transition and is removed after atomic server cutover.