mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
db0d44f3c7
EncryptedKVStore: AES-256-GCM wrapper over ZapDB for per-user shard encryption. Each user's key shards encrypted with a unique DEK: user DEK = HMAC-SHA256(masterKey, "mpc:shard:" + orgID + ":" + userID) org DEK = HMAC-SHA256(masterKey, "mpc:org:" + orgID) Three layers of MPC data protection: 1. ZapDB ChaCha20-Poly1305 (node-level, existing) 2. EncryptedKVStore AES-256-GCM (per-user, NEW) 3. API filter on createdBy (access control, NEW) Even if ZapDB is fully dumped, individual users' shards are independently encrypted. Wrong user key → decryption fails. 5 new tests: roundtrip, key uniqueness, wrong-key rejection, empty values, org vs user key separation.