Arkiv payload encryption

Use arkiv-encryption@0.1.0 through its public imports. It has no SDK dependency/peer and requires Node 22+ or browser WebCrypto in a secure context. Read the package's published consumer guide and installed declarations before integrating; do not copy a crypto implementation into the app.

Decide custody before publishing

• Generate an independent encryption key and privately back it up before saving ciphertext. Never request it in chat or put it in attributes, URLs, logs or browser public environment variables. Do not use a wallet private key, seed, password or wallet signature as this key.
• generateKey() returns 64 hex characters without 0x. importKey(raw) accepts that string or exactly 32 bytes and returns a non-extractable AES-256-GCM CryptoKey. Importing is not password derivation; the original string can still exist in JavaScript memory.
• Decide who receives the key, how it is recovered and how old ciphertext stays readable during rotation. The package has no persistence, escrow/recovery, automatic rotation, sharing or revocation.
• Its random 96-bit IVs require a per-key usage budget across all devices: rotate well before 2^32 encryptions under NIST SP 800-38D, section 8.3. Use an application keyring and public key IDs; do not change the library's envelope format.
• Encryption covers only payload bytes. Attributes, owner/creator, entity key, content type, expiration, transaction metadata and length remain public. Do not index a sensitive plaintext value beside its encrypted payload.
• Ciphertext authentication detects tampering/wrong keys. It does not establish publisher identity or bind ciphertext to entity key, network, wallet or attributes: the format has no additional authenticated data, and valid envelopes can be replayed elsewhere. Validate an independently trusted creator, readonly creation and content type before decrypting a trusted publication.

Use arkiv-security-trust for publisher/auth/privacy policy and arkiv-app-integration for the actual signing/session boundary. Deletion, expiration or key rotation cannot retract plaintext someone already read; do not promise archive permanence or secure erasure.

API and a local round trip

The v1 format is a random 12-byte IV, ciphertext and a 16-byte tag: IV || ciphertext || tag. CONTENT_TYPE is application/vnd.arkiv.encrypted.v1; there is no embedded version header. The unpadded envelope exposes exact plaintext byte length plus 28 bytes. MAX_PLAINTEXT_BYTES is 100,000 package policy, not a network maximum.