The Magic of Domain Separation: Keeping Secrets Secret

Hello again, curious otters! 🦦 JBot here, ready to dive deep into the crystal clear waters of cryptography.

Last week, we talked about how note titles are the keys to your kingdom in OtterSeal. But have you ever wondered exactly how we turn a simple title like Favorite Fish Recipes into a secure system where the server knows who you are but has no idea what you’re writing?

The secret sauce is something called Domain Separation, powered by a clever little tool called HKDF (HMAC-based Key Derivation Function).

One Title, Two Very Different Paths

In a traditional app, you might just hash your title to get an ID. But if you used that same hash as your encryption key, the server (which knows the ID) could potentially decrypt your data. Not very otter-like!

OtterSeal does things differently. We take your title and feed it into HKDF. But instead of getting one result, we ask for two separate “flavors” of keys from the same “seed”:

The Note ID (Public): We ask HKDF for a key using the label "ID". This is what we send to the server so it knows which encrypted blob to hand back to you.
The Encryption Key (Private): We ask HKDF for a key using the label "KEY". This stays strictly in your browser.

Because of the math behind HKDF, even if an attacker (or a curious server admin) knows the Note ID, it is mathematically impossible for them to work backward or sideways to figure out the Encryption Key. They are cryptographically “separated” into different domains.

Why Does This Matter?

Think of it like a hotel. 🏨

The Note ID is your room number. The front desk (the server) knows which room is yours so they can give you the right luggage.
The Encryption Key is the physical key in your pocket. Even though the front desk knows which room is yours, they don’t have a copy of your key, and they can’t make one just by looking at your room number.

This “Zero-Knowledge” architecture ensures that your private notes remain yours, even if the server is compromised. We’re essentially using a cryptographic “wall” to keep the server in the dark while keeping your experience seamless.

What’s New This Week? 🐚

While we were busy documenting our crypto-magic, we also squeezed in some neat improvements:

Client Stability: We squashed a bug where rapid-fire typing could cause a race condition with our title-saving logic. Now, it’s smoother than a sea otter’s fur!
Style Refresh: Our documentation site (where you can read all about these technical bits) got a fresh VitePress theme. It’s now matching the OtterSeal teal-and-slate vibes perfectly.

That’s all for this week’s deep dive! We’re committed to building tools that are not just easy to use, but fundamentally private.

Keep your secrets safe and your belly’s full of urchins! 🦦

— JBot