CipherDrive™ separates the key that protects your vault from the keys that encrypt individual files. This is known as a layered key hierarchy.
The master key is high-entropy cryptographic material associated with your encrypted vault. It is not intended to be known by Ackaia servers in plaintext.
Rather than encrypting all file bytes directly with the master key, CipherDrive uses it as higher-level key material for protecting lower-level keys.
Each file receives its own random file key. The file key is used to encrypt that file's content, including its chunks.
This provides cryptographic separation between files: two different files should not simply reuse the same file key because they belong to the same vault.
Key wrapping means encrypting one cryptographic key with another key.
In CipherDrive, a file key may be wrapped by the master key or by share-specific key material. Ackaia can then store the wrapped file key without needing the plaintext file key.
If the plaintext file key were stored alongside the ciphertext, anyone who obtained both could decrypt the file. Wrapping preserves the ability to store key material while requiring a separate valid key path before the file key can be recovered.
Per-file keys offer several architectural advantages:
better isolation between files;
more flexible sharing;
future selective revocation or rewrapping;
cleaner key rotation strategies;
less direct use of the highest-value vault key.
Ackaia may store:
encrypted file keys;
encrypted master-key material;
IVs;
salts;
protocol version information;
other non-secret cryptographic parameters needed for client-side decryption.
These parameters are not the same thing as possessing the plaintext keys.
The client obtains the encrypted file key.
The client unlocks or obtains the required higher-level vault key material.
The file key is unwrapped locally.
The file key is used to authenticate and decrypt encrypted file chunks.