Regulus: end-to-end encrypted file sharing

• Threat model: an 8-function client where the storage server is inside the adversary's trust boundary. It can read, overwrite, inject and diff the store between calls. The sole trust anchor is a write-once public keystore, which also proves username uniqueness, so wiping a user's record cannot free their name for impersonation.
• Authenticated encryption through one seal/open path: AES-CTR under a fresh IV, encrypt-then-MAC with HMAC-SHA-512 over the ciphertext, constant-time verification before any decryption. Key separation via HashKDF: every parent key and purpose label derives independent encryption and MAC keys, so no key crosses domains.
• KDF chain rooted in Argon2, salted with the username, which kills both offline dictionary speedups and a record-splice attack. Wrong password and tampered record return the same error: no oracle.
• Oblivious storage layout: a 4-type object graph whose addresses derive from a 16-byte master key, so filenames, their lengths, and file existence are all unguessable from a full read of the store. Only the login record sits at a public address, by necessity.
• Capability-based sharing: each reader holds an address-and-key pair to their own FileAccess node, the single indirection layer. Transitive revocation re-keys, relocates, and rewrites every surviving node, including sub-shares under filenames the owner has never seen. A missing node means revoked, not never existed.
• O(1) append: backward-linked chunks with the header at the tail, so 100 bytes appended to a 10 TB file moves 100 bytes. Overwrites reuse key and header, keeping every sharee on the live copy.
• Graded by a hidden adversarial suite plus a live design review.

Code for classes still running is kept private under Berkeley's academic-honesty policy. Happy to walk through it in person. ← Back to all projects