> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enver-os.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Zero-Knowledge Architecture

> How Enver ensures the server never has access to your plaintext secrets.

# Zero-Knowledge Architecture

Enver's core principle: **the server is a blind courier**. It moves bytes it cannot read.

## How it works

### Encryption (ev push)

```
Your .env content
      │
      ▼
  Generate random 256-bit master key
      │
      ▼
  Split key → 5 Shamir shares (threshold: 3)
      │
  Derive AES key from lock key via PBKDF2
  (100,000 iterations, SHA-256)
      │
      ▼
  AES-256-GCM encrypt .env content
      │
  ┌───▼────────────────────────────┐
  │  Upload to server:             │
  │  • ciphertext (encrypted .env) │
  │  • iv + salt                   │
  │  • 5 Shamir key shares         │
  └────────────────────────────────┘
  Server stores all of the above.
  Server does NOT have your lock key.
  Server CANNOT decrypt.
```

### Decryption (ev pull)

```
  ┌────────────────────────────────┐
  │  Download from server:         │
  │  • ciphertext                  │
  │  • iv + salt                   │
  │  • 5 Shamir key shares         │
  └───────────────────────────────┘
            │
            ▼
  Reconstruct master key from 3 of 5 shares
  (Shamir's Secret Sharing — locally)
            │
  Derive AES key from your lock key + salt
  (PBKDF2 — locally)
            │
            ▼
  AES-256-GCM decrypt → .env content
  (locally — plaintext never leaves your machine)
```

## Why Shamir's Secret Sharing?

A single encrypted key is still a single point of failure. By splitting the key into 5 shares with a threshold of 3:

* Any 3 shares are sufficient to reconstruct the key
* No single share reveals anything about the key
* Even if an attacker steals 2 shares from the server, they gain nothing

## Algorithms used

| Purpose              | Algorithm                                       |
| -------------------- | ----------------------------------------------- |
| Symmetric encryption | AES-256-GCM                                     |
| Key derivation       | PBKDF2 (SHA-256, 100,000 iterations)            |
| Secret splitting     | Shamir's Secret Sharing (5 shares, threshold 3) |
| Token hashing        | SHA-256                                         |