🛡️ ZERO-KNOWLEDGE ARCHITECTURE & SERVICE MANUAL

ZevSafe Knowledge Hub

Every feature, cryptographic primitive, memory boundary, and zero-knowledge guarantee disclosed in clear step-by-step instructions for everyday users and mathematical depth for auditors.

Showing 10 of 10 services Press / to search, ESC to clear
🔐
SERVICE #01

Core Streaming Vault

High-throughput chunked authenticated encryption engine. Streams archives up to 5 GB with bounded <150 MB RAM using the 57-byte ZV3 header and 4 MB ciphertext blocks.

AES-256-GCM STREAM AEAD v3 57B Header Emergency Sheet
Explore Service Guide →
📁
SERVICE #02

Virtual Filesystem & Live Editing

In-browser decrypted overlay filesystem. Create encrypted notes, edit Markdown files live, rename, delete, and trigger direct zero-export vault re-encryption.

In-Place Notes Live MD Editor Overlay Map Direct Re-Encrypt
Explore Service Guide →
🎭
SERVICE #03

Duress Decoy Vaults

Plausible deniability under physical or legal coercion. Unlocks innocent decoy files when forced to surrender a password, while keeping primary files undetectable.

Plausible Deniability Dual-Manifest V3_FLAG_DURESS Indistinguishability
Explore Service Guide →
🖼️
SERVICE #04

Polyglot Media Camouflage

Bicontextual file steganography. Masks raw .zev vaults behind valid JPEG, PNG, or MP4 headers so standard photo viewers display a real cover image while ZevSafe unlocks the vault.

Steganography FF D9 / IEND Sliding Window Bicontextual
Explore Service Guide →
🩺
SERVICE #05

Vault Health & Salvage Engine

Deep cryptographic integrity verification and emergency salvage. Scans every 4 MB chunk for bit-rot, quarantines corrupted blocks, and rescues surviving files into a clean archive.

Bit-Rot Scan Chunk Isolation Partial Salvage Audit Scorecard
Explore Service Guide →
🎬
SERVICE #06

Cinema Deck & Floating Audio Dock

Zero-RAM media playback directly inside the browser. Stream high-bitrate video, listen to podcasts via a persistent floating dock, and preview images with instant memory revocation.

Cinema Mode Floating Mini-Player Zero-RAM Blobs URL Revocation
Explore Service Guide →
🎲
SERVICE #07

Passwords & Auto-Lock Protocol

Cryptographic passphrase generation and session defense. CSPRNG Diceware generator with Shannon entropy calculation and idle auto-lock timers with cryptographic memory zeroization.

CSPRNG Diceware Shannon Entropy Inactivity Lock RAM Zeroization
Explore Service Guide →
🔑
SERVICE #08

Key Derivation & 2FA Keyfiles

High-work-factor brute-force immunity. Configure PBKDF2-SHA512 tiers from 600k up to 2,400,000 rounds combined with SHA-256 physical keyfile entropy mixing for true 2FA vaults.

PBKDF2-SHA512 2.4M Rounds Keyfile 2FA GPU Resistance
Explore Service Guide →
⚡
SERVICE #09

Mobile Streaming Storage

Four-tier storage fallback architecture (FSA → OPFS → Service Worker → In-Memory). Guarantees crash-free 5 GB encryption and decryption on low-RAM Android & iOS devices.

Tier 1 FSA Tier 3 OPFS Tier 2 SW Stream <150 MB RAM
Explore Service Guide →
💾
SERVICE #10

USB Air-Gap Backup Kit

1-Click standalone vault exporter to USB flash drives and offline storage. Pure-JS PKZIP archive engine, direct File System Access API drive writer, decoupled Google Fonts, and cross-platform zero-config launchers.

Pure-JS PKZIP Direct USB Drive Multi-OS Launchers Zero CDNs
Explore Service Guide →

Security Invariants & Cryptographic Matrix

Uncompromising guarantees enforced across all 10 ZevSafe services. Every cryptographic decision is verifiable client-side.

Domain / Service Cryptographic Primitives Key Parameters Memory / Network Boundary Adversary Threat Model
01. Core Streaming Vault AES-256-GCM + STREAM AEAD 4 MB Chunks, 96-bit Nonces (Counter + Last bit), 57B Header Peak RAM < 150 MB across 5 GB vaults. 0 bytes buffered to disk. Reordering, chunk truncation, ciphertext splicing, MITM tampering.
02. Virtual Filesystem Decrypted Overlay Map + Direct Re-encrypt Client-side SHA-256 path mapping, ephemeral session keys Zero disk persistence for plaintext modifications until explicit re-encrypt. Local storage forensic scraping, untrusted browser extension inspection.
03. Duress Decoy Vaults Dual AES-GCM Envelopes (`V3_FLAG_DURESS`) Distinct salt, IV, and 128-bit authentication tags per envelope Ciphertext indistinguishable from pseudorandom noise ($IND\text{-}CPA$). Coercion, border crossing searches, forensic proof of undisclosed data.
04. Polyglot Camouflage Steganographic Media Framing + Sliding Detector JPEG `0xFF 0xD9`, PNG `IEND`, MP4 `moov` marker detection Valid media stream prepended; unauthenticated vault silently bypasses parser. Deep packet inspection (DPI), automated media scanners, file type audits.
05. Vault Health & Salvage Fault-Tolerant AEAD Chunk Verification Per-chunk GCM tag verification, 16-byte isolation window Isolated chunk buffers. Corrupted blocks dropped; valid blocks rescued. Bit-rot, partial disk sector failure, incomplete download streams.
06. Cinema & Audio Dock In-Browser Web Cryptography + Object URL Revocation Ephemeral Blob URLs, MediaSource Extensions (MSE) Immediate `URL.revokeObjectURL()` on stop or modal close. Zero RAM leaks. DOM memory extraction, cross-origin resource leakage.
07. Passwords & Auto-Lock CSPRNG Diceware + Buffer Zeroization `crypto.getRandomValues()`, Shannon Entropy ≥ 77 bits, 5–60 min timer TypedArray `.fill(0)` on all key buffers immediately upon lock. Post-session memory dumps, cold-boot RAM attacks, unattended workstation snooping.
08. Key Derivation & 2FA PBKDF2-SHA512 + Keyfile Entropy Mixing 600,000 to 2,400,000 iterations, 32-byte salt, SHA-256 keyfile digest Hardware-bound key derivation. High time-memory cost. High-performance GPU cluster dictionaries, ASIC parallelized brute force.
09. Mobile Streaming Multi-Tier FSA / OPFS / Service Worker Pipeline 4 MB backpressure streams, transferable ArrayBuffers Strictly bounded peak memory < 150 MB on Android Chrome & iOS Safari. Mobile OS low-memory termination (OOM kill), multi-gigabyte upload traps.