File encryption
Key wrapping
For RSA-based KMS (Azure Key Vault with RSA-HSM):
Zero-Knowledge key encapsulation (post-quantum hybrid)
In Zero-Knowledge and Zero-Knowledge Strict rooms, the room encryption key (REK) is wrapped to each member’s identity key using a hybrid key-encapsulation mechanism that combines a classical and a post-quantum algorithm.
Because the combiner never XORs and binds the ML-KEM ciphertext and public key, an
attacker who breaks only X25519 — or only ML-KEM — still cannot recover the wrapped
key. This protects against “harvest-now, decrypt-later”: traffic captured today
stays confidential even against a future quantum computer. New enrolments use the
hybrid scheme; the wire format is versioned so legacy X25519 identities remain
readable. Client-side ML-KEM uses the audited
@noble/post-quantum library; the
server never holds Zero-Knowledge key material.
Audit log signatures
TLS
Password hashing
Random number generation
All random values (IVs, DEKs, salts, tokens) are generated using the operating system’s CSPRNG (getrandom on Linux, BCryptGenRandom on Windows).
What we do not use
- MD5 or SHA-1 for any security purpose
- ECB mode for any block cipher
- RSA-PKCS1v1.5 for encryption (only RSA-OAEP)
- Static IVs or nonces
- Client-side session secrets stored in localStorage