Encrypted file storage
SecureVault
Encrypted cloud storage using AES-256 and RSA hybrid encryption, with secure file sharing, access control, and documented REST APIs that validate every request.
Fig. 1 · Hybrid encryption, step by step
Conceptual
Select a component, or trace a scenario.
Each box is a part of the system; arrows show how a request or event moves between them.
Component
Component reference and scenarios as text
- Your file
- The file as uploaded. It is never stored like this.
- AES-256 key
- A random symmetric key. AES is fast enough to encrypt whole files.
- AES-256 encryption
- The file is encrypted with the AES key.
- Encrypted file
- Only ciphertext is stored. Without the AES key it is unreadable.
- Owner’s public key
- Used to encrypt (“wrap”) the AES key for the file’s owner.
- Wrapped key · owner
- The AES key, encrypted so only the owner’s private key can recover it.
- Recipient’s public key
- Used to wrap the same AES key for someone the owner shares with.
- Wrapped key · recipient
- The same AES key, wrapped for the recipient. Sharing never re-encrypts the file.
- Access control
- The API validates each request and checks the requester may access the file before releasing anything.
- Recipient decrypts
- The recipient unwraps the AES key with their RSA private key, then decrypts the file.
Encrypt & store
- A random AES-256 key encrypts the uploaded file.
- Only the ciphertext is stored.
- The AES key itself is encrypted with the owner’s RSA public key and kept alongside.
Share a file
- To share, the owner recovers the AES key with their private key…
- …and wraps it again with the recipient’s RSA public key. The file itself is untouched.
Open a shared file
- The API checks that the requester is allowed to access the file.
- The recipient receives the ciphertext and their own wrapped key.
- Their private key unwraps the AES key, which decrypts the file.
What I built
- Hybrid encryption. Files are encrypted with AES-256, and RSA protects the keys.
- Secure file sharing and access control, so only the right people can open a file.
- REST APIs with request validation and endpoint documentation.
- Docker packaging for the service.
Why hybrid encryption
AES is fast enough to encrypt whole files, but both sides need the same secret key. RSA solves the key-sharing problem but is far too slow for large files. Hybrid encryption uses each one where it fits: a random AES key encrypts the file, and RSA encrypts that small key. To share a file, you wrap the same AES key with the other person’s public key, and the file itself never has to be encrypted again.
About the figure
The diagram above shows the general hybrid-encryption pattern the project is built on. It isn’t a security audit, and no independent review or certification is implied.