PaperAI's Zero-Knowledge Security & Privacy Cheat Sheet

PaperAI is a document management app designed with a zero-knowledge security model, ensuring that the service operator cannot access plaintext user data, thereby solving the trade-off between convenience and privacy in cloud services through client-side cryptography and user-controlled AI analysis options.

Core Principles

Client-Side Cryptography: All sensitive cryptographic operations, including encryption and decryption of user documents and metadata, are exclusively performed on the user's device, ensuring that the server only stores encrypted data blobs and never possesses the keys required to access plaintext content, thus fundamentally limiting the impact of any potential server-side breach.
Zero-Knowledge Architecture: The entire system is meticulously designed to prevent the service operator from ever accessing the plaintext content of user documents, achieved by deriving master encryption keys locally from user passwords and employing a two-tier encryption system where unique document keys are generated and encrypted with the master key, all managed exclusively on the client side.

Action Steps

Implement Robust Client-Side Key Derivation and Management: Utilize a strong, memory-hard password-based key derivation function like Argon2id on the client device to generate both an authentication hash for server verification and a master encryption key that remains strictly on the device, ensuring that user passwords are never transmitted and the master key is purged from memory upon logout to minimize exposure.
Employ a Two-Tier Encryption Strategy with AEAD Ciphers: For each document, generate a unique Document Key on the client, use AES-256-GCM to encrypt the document and its associated metadata with this key, then encrypt the Document Key itself with the user's Master Encryption Key, ensuring confidentiality, integrity, and authenticity while limiting the scope of compromise and facilitating efficient password changes.

Pro Tips

Decouple Backend and Storage with Presigned URLs: To enhance security and maintain the zero-knowledge principle, design your architecture to decouple the backend database from the actual storage server, allowing the backend to orchestrate temporary, time-limited presigned URLs for direct client-to-storage uploads, ensuring that the backend servers never handle or see the encrypted document data itself.
Offer User-Controlled Privacy Options for AI Analysis: Recognize the inherent privacy challenges with AI-powered features and provide users with distinct options for data processing, such as local on-device analysis for maximum privacy, a trusted cloud service with strong data jurisdiction and transparency, and external/self-hosted API integration for ultimate user control, allowing individuals to choose their preferred balance of privacy, performance, and quality.

Pitfalls to Avoid

Relying on Server-Side Cryptography for Sensitive Data: A significant pitfall is entrusting the server with cryptographic keys or plaintext data, as this creates a single point of failure where a server-side breach would directly expose all user information, negating any claims of zero-knowledge security and forcing users to compromise privacy for convenience.
Using Weak or Outdated Key Derivation Functions: Employing password-based key derivation functions that are not memory-hard or are susceptible to GPU-based cracking attempts, such as older algorithms, significantly weakens the security posture, making user passwords vulnerable to brute-force attacks and compromising the foundational secret that protects all user data.

Real World Examples

A user scans a physical invoice into PaperAI, and the app, leveraging its client-side cryptography, encrypts the document and then uses an AI model (either locally or via a user-selected cloud option) to automatically extract the vendor, date, and categorize it as an expense, all while ensuring the plaintext content is never exposed to the service provider.: Secure Document Management with AI-Generated Metadata
When a user needs to change their password in PaperAI, the system efficiently decrypts all the small, encrypted Document Keys using the old Master Encryption Key (derived from the old password), then re-encrypts them with the newly derived Master Encryption Key (from the new password), avoiding the need to re-encrypt gigabytes of actual document data and maintaining data integrity without compromising privacy.: Efficient Password Reset in a Zero-Knowledge System