Skip to content
Draft
Changes from 1 commit
Commits
Show all changes
115 commits
Select commit Hold shift + click to select a range
2d080ea
add `"alg": "A256KW"` support for JWEs
overheadhunter Mar 2, 2024
d109cff
uvf metadata (WiP).
chenkins Feb 28, 2024
55633f1
remove dead code from `backend.ts` for now
overheadhunter Apr 13, 2024
fe7ff3d
disentangle v8 and uvf based vaults
overheadhunter Apr 13, 2024
be8803c
move vault format 8 code to separate file
overheadhunter Apr 13, 2024
b51cc59
move UVF code to separate file
overheadhunter Apr 13, 2024
a9f12d4
adjust UVF payload to latest spec
overheadhunter Apr 13, 2024
cdf5571
Merge branch 'develop' into feature/uvf
overheadhunter Apr 20, 2024
3f77d16
new JWE API supporting compact and JSON format
overheadhunter Apr 25, 2024
3646379
use correct `AlgorithmID` for Concat KDF
overheadhunter Apr 26, 2024
f1c14fd
added tests
overheadhunter Apr 26, 2024
e0a7ab1
Merge branch 'develop' into feature/uvf
overheadhunter Apr 28, 2024
aa1690f
type cleanup
overheadhunter Apr 28, 2024
e6e028a
include recovery key in UVF metadata
overheadhunter Apr 28, 2024
a85cf3c
create UVF-based vault
overheadhunter Apr 28, 2024
32f2743
store uvf metadata and recovery key in vault table
overheadhunter May 2, 2024
a63ef34
adjusted to DTO model
overheadhunter May 2, 2024
6ce1569
Merge branch 'develop' into feature/uvf
overheadhunter May 2, 2024
01c8a06
grant permission to UVF vault
overheadhunter May 2, 2024
36eb79c
fix autocompletion mistake
overheadhunter May 2, 2024
3cf9c8e
use common interfaces for VF8 and UVF
overheadhunter May 2, 2024
69f0360
fix linter errors
overheadhunter May 2, 2024
7bddc62
experimental implementation of `serializePrivateKey()`
overheadhunter May 2, 2024
ba05d8b
make config.ts usable during tests
overheadhunter May 2, 2024
3d1db01
deduplicate "encrypt for user"
overheadhunter May 3, 2024
6b46862
store recovery key among vault key in access token
overheadhunter May 3, 2024
cb4e53a
reordered fields
overheadhunter May 3, 2024
b294f55
store recovery key as PKCS8 instead of words
overheadhunter May 9, 2024
a3fc184
adjusted parameter order
overheadhunter May 9, 2024
aeafffe
fix mocha test explorer: `document is not defined`
overheadhunter May 9, 2024
17c7099
fix method signature
overheadhunter May 9, 2024
f3f3e02
relax linter
overheadhunter May 9, 2024
aa49371
add tests
overheadhunter May 9, 2024
eda2621
add tests
overheadhunter May 9, 2024
815199f
reduce public API surface
overheadhunter May 9, 2024
037157f
add tests
overheadhunter May 9, 2024
2a40d01
speed up tests by reducing KDF iteration count
overheadhunter May 9, 2024
5118876
Merge branch 'develop' into feature/uvf
overheadhunter May 9, 2024
e4f9865
renamed files
overheadhunter May 10, 2024
e27d20a
clean up tests
overheadhunter May 10, 2024
657598a
fix uneffective test
overheadhunter May 10, 2024
88a95eb
clean up test
overheadhunter May 10, 2024
c229fdd
remove outdated TODOs
overheadhunter May 10, 2024
b46f55e
restore recovery key from human-readable form
overheadhunter May 10, 2024
b0790aa
store JWK Set in backend
overheadhunter May 10, 2024
98cd173
expose `jwks.json` and `vault.uvf` endpoints
overheadhunter May 10, 2024
00641e4
switch to MemberDto
overheadhunter May 16, 2024
4f3e969
cleanup
overheadhunter May 16, 2024
8320786
include role-depending data in access token
overheadhunter May 16, 2024
458e98a
Merge branch 'develop' into feature/uvf
overheadhunter May 16, 2024
8cb9af6
add `UniversalVaultFormat.recover(...)`
overheadhunter May 16, 2024
aad13fa
Merge branch 'develop' into feature/uvf
overheadhunter May 17, 2024
686713b
Merge branch 'develop' into feature/uvf
overheadhunter May 17, 2024
994d7b3
Merge branch 'develop' into feature/uvf
overheadhunter May 17, 2024
155d640
remove unnecessary guard
overheadhunter May 17, 2024
9b4f5ba
fix weird error message in unit tests
overheadhunter May 21, 2024
388426f
pass in URL during vault template generation
overheadhunter May 21, 2024
52b97b5
improve test
overheadhunter May 21, 2024
7224b46
add root directory to vault template
overheadhunter May 21, 2024
81e9ab4
split up `computeDirId` and `computeDirIdHash`
overheadhunter May 21, 2024
9c3ab12
add `dir.uvf` file to vault template
overheadhunter May 21, 2024
ec4415d
refine test
overheadhunter May 22, 2024
2947b80
show also uvf recovery key in vault details
infeo May 22, 2024
2d03e39
fix linter hints
infeo May 22, 2024
bf85c2a
(unfinished) rework recover Vault dialog
infeo May 27, 2024
8d86446
Do not erase uploaded file on failed upload
infeo May 28, 2024
57cfd0a
improve error handling
infeo May 28, 2024
b1f9fc4
define event listeners as functions
infeo May 28, 2024
a667e0d
remove unused Error class
infeo May 28, 2024
871b6de
set vault type during recovery
infeo May 28, 2024
3368768
minor adjustments
infeo May 28, 2024
b43a946
add additional verification to vaultformat 8 module
infeo May 29, 2024
ea77daf
Add negative test for vaultFormat8 verfiy and recover
infeo May 30, 2024
c2fe768
reduce diff
infeo May 30, 2024
b2cb75d
add doc string
infeo Jun 3, 2024
64d8ff6
add tests for simple jwt parsing
infeo Jun 3, 2024
eaaad24
improve error handling
infeo Jun 3, 2024
597b2cc
add error translations
infeo Jun 3, 2024
b7a0687
more wording/translations
infeo Jun 5, 2024
afd370f
fix display bug
infeo Jun 5, 2024
0de22c9
Merge branch 'develop' into feature/uvf
overheadhunter Jun 6, 2024
917fedc
use new JWE parser in `userdata.ts`
overheadhunter Jun 6, 2024
847ecc4
dedup
overheadhunter Jun 6, 2024
26369a5
adjust DTO to carry both EC keys
overheadhunter Jun 6, 2024
e77ca7a
Merge branch 'develop' into feature/uvf
overheadhunter Jul 12, 2024
3e30a00
Merge branch 'develop' into feature/uvf
overheadhunter Nov 3, 2024
fd0add4
fixed test
overheadhunter Nov 3, 2024
68eb5d9
fixed linter warnings
overheadhunter Nov 3, 2024
ebd5f7d
Merge branch 'develop' into feature/uvf
overheadhunter Jan 17, 2025
4268484
make tests run from IDE again
overheadhunter Jan 17, 2025
3ca8f78
linter error
overheadhunter Jan 17, 2025
a0ce488
spec is final now
overheadhunter Jan 17, 2025
da7fe40
encode keys with base64url; values with base64
overheadhunter Jan 17, 2025
3cc7d27
use corrected test vectors confirmed in java
overheadhunter Jan 17, 2025
f684a58
fix incorrect hkdf output size
overheadhunter Jan 17, 2025
12106cc
Merge branch 'develop' into feature/uvf
overheadhunter Jan 31, 2025
c1d6c29
reordered flyway migrations
overheadhunter Jan 31, 2025
5a38a4d
Merge branch 'develop' into feature/uvf
overheadhunter Feb 7, 2025
fd6db88
reordered migrations
overheadhunter Feb 7, 2025
1f0b7c6
Merge branch 'develop' into feature/uvf
overheadhunter Feb 24, 2025
cd68e29
Merge branch 'develop' into feature/uvf
overheadhunter Mar 22, 2025
3a65446
Merge branch 'develop' into feature/uvf
overheadhunter Apr 24, 2025
b5a94a9
use base64url in `vault.uvf`
overheadhunter Apr 24, 2025
7e285ea
fix base64url encoding and tests
overheadhunter Apr 24, 2025
6efd702
fix test broken during merge cd68e29
overheadhunter Apr 24, 2025
ce36aa1
run linter
overheadhunter Apr 24, 2025
928b613
Merge branch 'develop' into feature/uvf
overheadhunter May 2, 2025
9fb01db
Merge branch 'develop' into feature/uvf
overheadhunter Jul 8, 2025
27a944d
use 512 bit keys for HMAC-SHA256 as per spec
overheadhunter Jul 8, 2025
b882d6b
Merge branch 'develop' into feature/uvf
tobihagemann Jul 18, 2025
6318fb6
Merge branch 'develop' into feature/uvf
overheadhunter Aug 28, 2025
85f4d30
force big-endian seed IDs
overheadhunter Sep 2, 2025
e7dceec
use `Uint8Array<ArrayBuffer>` (TS 5.7 adjustments)
overheadhunter Sep 2, 2025
703d092
use `Uint8Array<ArrayBuffer>` (TS 5.7 adjustments)
overheadhunter Nov 5, 2025
ce24d91
add missing protected header params
overheadhunter Nov 5, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions frontend/src/common/universalVaultFormat.ts
Original file line number Diff line number Diff line change
Expand Up @@ -320,9 +320,14 @@ export class VaultMetadata {
*/
public async encrypt(apiURL: string, vault: VaultDto, memberKey: MemberKey, recoveryKey: RecoveryKey): Promise<string> {
const recoveryKeyID = `org.cryptomator.hub.recoverykey.${await getJwkThumbprintStr(recoveryKey.publicKey)}`;
// see https://github.com/encryption-alliance/unified-vault-format/tree/develop/vault%20metadata#jose-header
const protectedHeader: JWEHeader = {
origin: `${apiURL}/vaults/${vault.id}/uvf/vault.uvf`,
jku: 'jwks.json' // URL relative to origin
// enc: 'A256GCM', // will be set by JWE.build()
cty: 'json',
crit: ['uvf.spec.version'],
'uvf.spec.version': 1,
'cloud.katta.origin': `${apiURL}/vaults/${vault.id}/uvf/vault.uvf`, // single source of truth for this vault
Copy link
Contributor

@chenkins chenkins Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@overheadhunter is this katta only? Does not make sense upstream?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you're right, should be org.cryptomator here...

jku: 'jwks.json', // URL relative to cloud.katta.origin
Comment on lines +329 to +330
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@overheadhunter Also: the spec says:

As the current version of this specification only allows for predefined parameter values, nothing but the parameter order may change. The base64url-encoded version of the protected header for spec version 1 should therefore always be this:

echo eyJlbmMiOiJBMjU2R0NNIiwiY3R5IjoianNvbiIsImNyaXQiOlsidXZmLnNwZWMudmVyc2lvbiJdLCJ1dmYuc3BlYy52ZXJzaW9uIjoxfQ | jq -R '@base64d | fromjson'
{
  "enc": "A256GCM",
  "cty": "json",
  "crit": [
    "uvf.spec.version"
  ],
  "uvf.spec.version": 1
}

Do I misread the spec or ar origin and jku not allowed?

};
const jwe = await JWE.build(this.payload(), protectedHeader).encrypt(Recipient.a256kw('org.cryptomator.hub.memberkey', memberKey.key), Recipient.ecdhEs(recoveryKeyID, recoveryKey.publicKey));
const json = jwe.jsonSerialization();
Expand Down
Loading