How Large Files Are Uploaded and Encrypted

CipherDrive™ does not need to load an entire large file into memory and then encrypt it as one enormous operation. Instead, the documented architecture can divide files into chunks and encrypt those chunks locally before upload.

This makes client-side encryption practical for files that are much larger than the amount of memory the browser should reasonably dedicate to one operation.

The high-level flow

For a supported large-file upload, the conceptual process is:

  1. You select the file.

  2. Applicable pre-encryption safety checks may run.

  3. The client generates a random key specifically for that file.

  4. The file is divided into ordered chunks.

  5. Each chunk is encrypted locally using the file key.

  6. Each encrypted chunk is uploaded.

  7. The file key is wrapped with higher-level vault key material.

  8. Ackaia stores the encrypted chunks, encrypted key material, and necessary operational metadata.

The server does not need the plaintext file key to store the resulting ciphertext.

Why use a different key for each file?

CipherDrive uses per-file keys rather than encrypting every file directly with one master key.

This provides useful separation:

How each chunk is protected

CipherDrive's documented cryptographic design uses AES-GCM for authenticated encryption.

AES-GCM provides two properties at the same time:

Why every chunk needs a unique IV

AES-GCM has an important security requirement: an initialization vector, or IV, must not be reused with the same key.

CipherDrive's documented chunking design conceptually builds a unique 96-bit IV for each chunk from:

Conceptually:

Chunk IV = random file nonce + chunk number

The random part differs between files, while the chunk number changes for each chunk in that file. This is designed to avoid IV reuse under the same file key.

Technical note: IV uniqueness is critical for AES-GCM security. Reusing an IV with the same key can seriously weaken confidentiality and integrity guarantees.

Does Ackaia see the contents of each chunk?

After client-side encryption, Ackaia receives encrypted chunk data rather than the readable file contents for ordinary encrypted storage.

Ackaia can still require operational information to store and reconstruct the encrypted object, enforce quotas, coordinate transfers, and maintain reliability.

This can include encrypted size, object identifiers, chunk or upload state, timestamps, account association, region placement, and other operational metadata.

What happens when I download the file?

The client performs the reverse operation:

  1. CipherDrive verifies that the request is allowed.

  2. The client obtains the encrypted file key and required cryptographic parameters.

  3. The client unwraps the file key using the vault material available locally.

  4. Encrypted chunks are downloaded.

  5. Each chunk is authenticated and decrypted locally.

  6. The client reconstructs the original file.

If a chunk has been corrupted or altered in a way that breaks its authenticated encryption, decryption should fail rather than treating the modified data as valid.

Why chunking helps large uploads

Chunking can provide several implementation benefits:

The presence of a chunked architecture does not mean every CipherDrive client or every operation guarantees automatic resume. Actual resume behavior depends on the current client implementation and service configuration.

Can large files still fail?

Yes. Client-side encryption still depends on the device, browser, available memory, CPU, network connection, account limits, transfer limits, and service state.

A very large file may fail because:

What does this mean for privacy?

The important privacy property is not simply that a file is “encrypted at rest.” It is that, for supported workflows, CipherDrive performs the content encryption in the user's client before ordinary encrypted storage, while Ackaia stores encrypted chunks and wrapped key material without ordinarily possessing the plaintext file key needed to read them.