# Secret Files v1

Independent original implementation for Netrina NYC, not a VeraCrypt port. No VeraCrypt/TrueCrypt code or artwork is incorporated. Not compatible with VeraCrypt. Source modules alongside this document are the exact deployed implementation. No external scripts, upload endpoints, analytics, cookies or browser persistent storage are used by this application. The standalone page restricts connections with `connect-src 'none'`.

## Format

All integers are big endian. Fixed 64-byte header: bytes 0–7 ASCII NYSFILE1; 8–23 random 128-bit salt; 24–31 random 64-bit IV prefix; 32–39 original size as IEEE754 float64, restricted to safe nonnegative integers up to 1 TiB; 40–43 chunk size 1048576; 44–47 PBKDF2 iterations 600000; 48–63 reserved zero bytes. Original size is public.

PBKDF2-HMAC-SHA256 derives a nonextractable AES-256-GCM key from the UTF-8 password (no normalization), salt, and fixed iteration count. A fresh salt and IV prefix are generated with crypto.getRandomValues for every encryption. Password strength still matters.

Each record uses a 96-bit IV = prefix || uint32 record index and 128-bit GCM tag. Associated data = exact 64-byte header || uint32 record index. Record zero is encrypted metadata: 1024 plaintext bytes containing uint32 JSON length, UTF-8 JSON {name}, and zero padding. Data records have indices 1..max(1,ceil(size/1048576)). An empty input has one authenticated empty data record. Every record has a unique IV under the file key. The final data record has the exact remaining plaintext size. The expected encrypted file size is 1104 + original size + 16 * record count. Extra bytes and truncation are rejected. Reordering, substitution, metadata alteration and header modification fail authentication. Changing a file requires fresh preparation, salt and key.

## Saving and limits

Files are read sequentially in 1 MiB blocks. Direct file saving is used only where the browser exposes showSaveFilePicker in the top-level page. It uses an atomic writable stream, closed only after all authentication succeeds. Failures/cancellation abort the stream. Select a new destination; nonempty destinations are rejected. An empty destination placeholder may remain after cancellation depending on the browser.

Other browsers use a final Blob download with a conservative output budget: 32 MiB on mobile/low-memory devices, 64 MiB by default, 128 MiB when deviceMemory reports at least 8 GiB. These are application limits, not free-memory measurements or guarantees; system memory and disk availability can still cause failure. Supported direct-save inputs are capped at 1 TiB in this format. Actual multi-gigabyte operation and physical iPhone behavior have not been certified.

No password recovery. Originals are not deleted. Prepared keys expire after five idle minutes. Cancellation is checked between browser crypto operations. JavaScript garbage collection does not guarantee secure erasure. Downloads are application/octet-stream and restored files are never executed or previewed. This code and custom container have not undergone an independent security audit. Use native audited software where that assurance is required. A compromised device or maliciously modified website can capture secrets; this application does not provide anonymity, hidden volumes or full-disk encryption.