Building Production-Grade End to End Encrypted App...
summary
Skiff describes a working E2EE production stack: client-side keys derived via Argon2id + HMAC KDF, SRP/OPAQUE for phishing-resistant auth, per-user signing and encryption keypairs, and a recoverable Shamir (3-of-2) recovery key that lets users reset passwords without losing data. Files use a 32-byte symmetric data key encrypted by user public keys so sharing only re-encrypts the small key, not the file. Real-time uses CRDTs, schema evolution uses protobufs, and observability explores the IETF Distributed Aggregation Protocol; client integrity and large-scale re-encryption remain practical challenges.
AI-written summary · about
chapters (12)
- 0:00Introduction to Skiff
- 1:27E2EE challenges
- 5:03Authentication and keys
- 8:30Account recovery
- 11:16Encryption and sharing
- 17:02Folder structures
- 19:21Traditional app security
- 21:57Real-time collaboration
- 24:35Data migrations
- 27:16Observability and privacy
- 30:14Conclusion and Q&A
- 32:41Deep dive Q&A
related talks
24mEnd-to-End encryption for iOS Developer
05mEnd to End Encryption for Mobile Developers
47mIs a Secured (Web) App Possible?
01h 07mBuilding Rock-Solid Encrypted Applications
45mZero Knowledge; Meeting the Growing Demand for Security and Privacy
29mProtecting data vs systems: practicality, performance, and problems...
15mSecret Key Recovery in a Global-Scale End-to-End Encryption System
25mSplitting Secrets for Encrypted Backups