What Makes an Architecture Zero-Knowledge?

A zero-knowledge architecture is one where the service provider has zero ability to access customer data in its unencrypted form. This isn't just a policy promise — it's a mathematical guarantee enforced by the system's design.

The key differentiator from traditional architectures:

Traditional: Server receives plaintext → Server encrypts → Server stores ciphertext + key. The server can decrypt AT ANY TIME.

Zero-Knowledge: Client encrypts with user's key → Client sends ciphertext to server → Server stores ciphertext ONLY. The server CANNOT decrypt. Ever.

This architecture means that even if the server is compromised, subpoenaed, or operated by a malicious insider, the data remains protected by the user's key which never left the user's device.

The ZeroLatch Zero-Knowledge Model

ZeroLatch implements zero-knowledge architecture through several mechanisms:

Client-Side Key Derivation: When you set an encryption password, PBKDF2 is used to derive a 256-bit AES key entirely in your browser. The password and key never leave your device.

AES-256-GCM Encryption: Files are encrypted in the browser using the derived key. GCM mode provides both confidentiality (encryption) and integrity (authentication).

Server-Side Ignorance: The server receives and stores only: ciphertext, initialization vector (IV), and salt. Without the key (which it never had), these are meaningless.

Release Without Revelation: When the dead man's switch triggers, the server releases the encrypted files to recipients. Recipients must know the encryption password (shared via a separate channel) to decrypt. The server facilitates the transfer without ever accessing the content.

Metadata Minimization: Beyond the encrypted payload, ZeroLatch minimizes metadata collection. Activity logs are used for essential functionality (heartbeat tracking) but redact PII.

Trust Verification

How can you verify a service's zero-knowledge claims?

Open-Source Code: If the client-side code is open source, security researchers can verify that encryption happens client-side and keys are never transmitted.

Network Inspection: Use browser developer tools to inspect network requests. You should never see plaintext data or encryption keys leaving your browser.

Third-Party Audits: Reputable services undergo independent security audits that validate their zero-knowledge claims.

Reproducible Builds: Advanced verification involves compiling the client code yourself and confirming it matches the deployed version.

Zero-knowledge architecture is the strongest possible privacy guarantee a service can offer. It shifts the trust model from "we promise not to read your data" to "we are mathematically incapable of reading your data."