ONLINE FILE LOCKER

1. Introduction: Client-Side Zero-Knowledge Encryption

File Locker provides impenetrable, client-side cryptographic encapsulation for sensitive digital assets. In a landscape saturated with centralized cloud vaults vulnerable to subpoena orders, unauthorized credential scraping, and silent data breaches, this suite restores total data sovereignty to the individual.

Operating on a strict Zero-Knowledge Architecture, the entire cryptographic pipeline executes inside the host device’s volatile browser memory (RAM) via the native W3C Web Cryptography API (window.crypto.subtle). Master passphrases and plaintext file streams are never transmitted over telecommunication networks, written to remote disks, or exposed to third-party APIs.

2. System Nomenclature & Interface Indicators

Understanding the operational controls ensures seamless security workflows:

1. Lock Mode (The Encryption Cipher): The transformation state that converts plaintext binary streams into an authenticated ciphertext container (.enc), paired with unique cryptographic initialization vectors.
2. Unlock Mode (The Decryption Decoupler): The extraction state that parses authenticated containers, verifies cryptographic tags against tampering, and restores the original file with its canonical name and extension.
3. The Non-Cloud Arrow (Air-Gapped Ingestion): Unlike standard upward arrows symbolizing cloud uploads, this icon designates direct byte-stream transfer into sandboxed hardware memory without internet traversal.
4. Masked Input & Privacy Eye Toggle: Employs CSS disc masking (-webkit-text-security) to mitigate visual shoulder-surfing in public environments, accompanied by an inspection toggle to verify passphrase accuracy before compilation.
5. Memory Safety Modal (Double-Check Popup): An un-bypassable confirmation checkpoint ensuring operators consciously memorize or vault their passphrase before the download executes.
6. Proprietary Magic Header (GASENC1): A standardized 7-byte binary sequence (0x47 0x41 0x53 0x45 0x4E 0x43 0x31) prepended to containers to prevent processing alien or malformed binary streams.

3. Technical Operator's Manual (Step-by-Step)

Phase A: Encapsulating Assets (Lock Mode)

1. Select Mode: Ensure the top selector is set to Lock (highlighted in red).
2. Stage Target Payload: Drag and drop any file (such as .zip, .pdf, .mp4, or raw database backups) into the spacious dropzone, or click to open your OS file dialog. The interface validates file presence and byte size.
3. Supply Passphrase: Input an entropy-dense passphrase into the password box. Use the eye toggle to ensure zero typographic errors.
4. Execute & Confirm: Click Lock & Download. The safety modal will display your passphrase. Confirm acknowledgment, prompting the cryptographic derivation, AES-GCM ciphering, container assembly, and automated file download ([original_filename].enc).

Phase B: Decapsulating Assets (Unlock Mode)

1. Toggle Mode: Click the Unlock switch at the top.
2. Ingest Encrypted Container: Drop your verified .enc file into the dropzone. The system reads the initial 7 bytes to authenticate the GASENC1 header. If foreign or corrupt files are introduced, an Access Denied integrity exception is thrown.
3. Supply Passphrase: Type the exact passphrase utilized during the locking phase.
4. Restore Master Payload: Click Unlock & Restore. The engine recalculates the derived key, verifies the Galois Authentication Tag (GCM Tag), and automatically triggers the download of the restored plaintext file with its original filename and extension.

4. Historical Evolution: From Caesar Ciphers to Rijndael & GCM

Cryptography has evolved from primitive substitution mechanisms—such as the Spartan Scytale and the Roman Caesar Cipher—into sophisticated mathematical transformations governed by Claude Shannon’s principles of Confusion and Diffusion.

During the late 20th century, the aging Data Encryption Standard (DES) became vulnerable to brute-force attacks due to its diminutive 56-bit key length. In 1997, the National Institute of Standards and Technology (NIST) initiated an international multi-year competition to develop a successor. Belgian cryptographers Vincent Rijmen and Joan Daemen presented the Rijndael Cipher, celebrated for its algebraic elegance, resistance to differential cryptanalysis, and high computational efficiency. In 2001, it was formally codified as the Advanced Encryption Standard (AES).

Early implementations often paired AES with Cipher Block Chaining (CBC) mode, which required separate hashing functions (such as HMAC) to detect tampering and was prone to padding-oracle vulnerabilities. To resolve this, David A. McGrew and John Viega introduced Galois/Counter Mode (GCM) in 2004. AES-GCM combines counter-mode confidentiality with universal hashing over a binary Galois field $\text{GF}(2^{128})$, establishing modern Authenticated Encryption with Associated Data (AEAD).

5. Compliance, International Standards & Consortia

The cryptographic pipeline adheres to stringent international specifications and regulatory data-protection frameworks:

• NIST FIPS PUB 197: Advanced Encryption Standard (AES) specification, implementing symmetric block cipher evaluations across 256-bit cryptographic keys.
• NIST Special Publication 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) for Confidentiality and Authenticity.
• RFC 2898 / PKCS #5 v2.0: Password-Based Cryptography Specification, utilizing the PBKDF2 key derivation function with 100,000 hashing rounds of HMAC-SHA-256 to counteract GPU-accelerated dictionary attacks.
• W3C Web Cryptography API Recommendation: Hardware-accelerated cryptographic primitives executed natively within sandboxed browser environments via window.crypto.subtle.
• EU General Data Protection Regulation (GDPR - Article 32): Fully complies with technical measures mandates ("Security of Processing") through end-to-end client-side pseudonymization and zero-server retention.

6. Key Application Advantages & Architectural Strengths

7. Cryptographic Formulation & Binary Architecture

The encapsulation architecture integrates key stretching, authenticated ciphering, and binary serialization into a single contiguous array.

Key Derivation Function (PBKDF2)

The 256-bit cryptographic key $K$ is derived from the user passphrase $P$ and a cryptographically generated 128-bit salt $S \in_R \{0, 1\}^{128}$ across $c = 100{,}000$ iterations:

$$K = \text{PBKDF2}(\text{PRF} = \text{HMAC-SHA-256},\; P,\; S,\; c = 100{,}000,\; dkLen = 256)$$

Authenticated Encryption (AES-GCM 256)

Given plaintext payload $M$ and a 96-bit Initialization Vector $IV \in_R \{0, 1\}^{96}$, AES-GCM produces ciphertext $C$ and an authentication tag $T \in \{0, 1\}^{128}$:

$$C = M \oplus \text{CTR}_K(IV), \quad T = \text{GHASH}_H(A, C, \text{len}(A) \parallel \text{len}(C)) \oplus E_K(J_0)$$

Binary Container Serialization Layout

The resulting downloadable .enc container is structured via linear byte concatenation:

Container = Magic_Header (7B) || Salt (16B) || IV (12B) || Length_Filename (2B) || Filename (UTF-8) || Ciphertext_With_Tag

• Magic_Header (7 Bytes): [0x47, 0x41, 0x53, 0x45, 0x4E, 0x43, 0x31] (GASENC1).
• Salt (16 Bytes): 128-bit CSPRNG salt passed to the PBKDF2 function upon decapsulation.
• Initialization Vector (12 Bytes): 96-bit unique CSPRNG nonce ensuring distinct ciphertexts for identical plaintext inputs.
• Length_Filename (2 Bytes): Little-Endian 16-bit unsigned integer ($\text{Uint16}$) holding the byte size of the original filename.
• Filename (UTF-8): Raw variable-length byte string preserving the source name and extension.
• Ciphertext_With_Tag: The encrypted payload terminating with the 16-byte GCM authentication tag.

8. Final Word & Support Our Mission

Cryptographic privacy is an indispensable shield in an age of automated surveillance and centralized data monopolies. File Locker was conceived to provide developers, financial professionals, journalists, and privacy advocates with an uncompromised, zero-footprint encryption station directly within the modern browser.

If this utility empowers your operational security workflow, consider supporting our open research, bookmarking and sharing this platform with colleagues, and reporting edge-case behaviors. Guard your passphrases, maintain verified offline backups, and stay sovereign.