In an end-to-end encrypted notes app, where does encryption happen?

E2E encryption encrypts on the sender's device before transmission. The server never sees plaintext.

What can a server administrator see if notes are end-to-end encrypted?

The server stores only ciphertext. Without keys, it cannot decrypt. Plaintext is never exposed to the server.

What is the purpose of a salt in password-based encryption?

Salt prevents attackers from precomputing hashes of common passwords and ensures unique keys per user.

Which term describes a one-time random value that ensures identical plaintext encrypts differently each time?

The IV (initialization vector) or nonce ensures semantic security by randomizing encryption output.

What is the fundamental difference between symmetric and asymmetric encryption?

Symmetric encryption (AES) uses one shared secret. Asymmetric (RSA) uses a public key and private key pair.

Which algorithm is described as 'fast, authenticated symmetric cipher'?

AES-GCM (Galois/Counter Mode) is a modern symmetric cipher providing both confidentiality and authentication.

What is a KDF and why is it needed?

A KDF (like PBKDF2) strengthens user passwords by iterative hashing, making them suitable for encryption.

How do you access the Web Crypto API in JavaScript?

All Web Crypto operations are accessed through window.crypto.subtle, which is available in modern browsers.

What return type do Web Crypto API methods use?

All crypto.subtle methods return Promises, requiring await or .then() for handling results.

Which Web Crypto operation encrypts one key with another key?

wrapKey encrypts a CryptoKey using another key; unwrapKey decrypts a wrapped key.

What happens when you call exportKey on a CryptoKey marked as non-extractable?

Non-extractable keys cannot be exported. The exportKey call throws an error, preventing raw key material from leaving the browser.

Why can't you use a user's password directly as an AES-256 encryption key?

Passwords are short, guessable, and lack randomness. PBKDF2 strengthens them into proper cryptographic keys.

How many iterations does a secure PBKDF2 implementation typically use?

Modern standards recommend 310,000+ iterations to slow down brute-force attacks on the password.

What is the purpose of the 310,000 iterations in PBKDF2?

Each iteration re-hashes the result. 310,000 iterations mean an attacker must perform 310,000 hashes per guess.

In the PBKDF2 → AES-GCM flow, where is the salt stored?

Salt is not secret; it is stored with the ciphertext. Its role is to prevent rainbow table attacks, not to hide keys.

What problem would occur if you encrypted two notes with the same plaintext and data key but forgot to generate a new IV?

Reusing IV with the same key breaks security. Identical plaintext + same key + same IV = identical ciphertext, leaking information.

Why use per-note data keys instead of encrypting all notes with the master key directly?

With per-note keys, changing password only requires re-wrapping data keys, not re-encrypting note content.

What is the key hierarchy in an E2E encrypted notes app?

Password is converted to master key via PBKDF2; master key wraps per-note data keys; data keys encrypt note content.

If a user changes their password, what must happen in an E2E notes app?

Password change generates a new master key via PBKDF2. Data keys stay the same but are re-wrapped with the new master key.

What advantage does the key hierarchy provide for sharing?

Per-note data keys enable sharing specific notes; master key (access to all notes) remains private.

Why can't Alice simply send Bob her master key to share a note?

Master key unlocks all notes. Sharing must be granular; only the specific note's data key should be shared.

In the RSA-OAEP sharing flow, what does Alice use to wrap the note's data key?

Alice uses Bob's public key to encrypt. Only Bob's private key can decrypt it; intermediate parties cannot unwrap.

What does Bob do to access a note shared with him via RSA-wrapped data key?

Bob uses his private key to unwrap the shared data key, then uses that key to decrypt the note ciphertext.

How would Alice revoke Bob's access to a shared note without re-encrypting the note?

The server stores the wrapped data key. Deleting it revokes access; Bob cannot unwrap the note without the wrapped key.

What is the security benefit of RSA-OAEP over basic RSA encryption?

OAEP is a padding scheme that prevents deterministic and chosen ciphertext attacks on RSA.

What does 'non-extractable' mean for a CryptoKey?

Non-extractable keys prevent exportKey() calls. Raw bytes never appear in JavaScript, enhancing security.

Where can you securely store a non-extractable CryptoKey between browser sessions?

IndexedDB can store CryptoKey objects directly, even non-extractable ones, across sessions.

What happens if you try to export a non-extractable key from IndexedDB?

Exporting a non-extractable key throws an error, preventing unauthorized key material leakage.

Why is IndexedDB safer than localStorage for storing encryption keys?

localStorage requires JSON export, exposing key bytes. IndexedDB stores CryptoKey objects in internal format.

What is the origin sandboxing policy for IndexedDB?

IndexedDB is sandboxed by origin. Different websites cannot access each other's data.

In an E2E encrypted notes app architecture, which component is responsible for encryption?

All encryption happens on the user's browser before data leaves the device. The server never handles plaintext.

What data does the server store in an E2E encrypted notes system?

Server stores ciphertext and public keys. Private keys and plaintext never reach the server.

How does a Service Worker support an E2E encrypted notes app?

Service Worker enables offline use by caching ciphertext. Decryption still happens client-side when needed.

What is the trust boundary assumption in an E2E encrypted notes app?

E2E encryption assumes the server, network, and other parties are untrusted. Only the user's device is trusted.

What is a potential challenge when multiple devices edit the same E2E encrypted note offline?

Server stores only ciphertext. Offline edits on multiple devices create sync conflicts that the client must resolve.

What is a metadata leakage risk in E2E encrypted notes apps?

Server can see when notes are created/updated and who shares with whom, even if content is encrypted.

Why might encrypting large notes be a performance bottleneck in the UI?

Large encryption operations on the main thread can cause UI lag. Web Workers can offload this work.

What is a risk if a user loses their RSA private key backup?

If the private key is lost, no new decryption is possible. Shared notes wrapped with the public key become inaccessible.

Which cryptographic operation ensures that a message has not been tampered with?

AES-GCM provides both confidentiality (encryption) and authenticity (detecting tampering).

What is the relationship between salt randomness and password uniqueness across users?

Random salt ensures that two users with identical passwords derive different keys, preventing precomputed hash attacks.

How does a recipient obtain the public key of the note sharer?

Public keys are not secret and can be stored on the server or public keybase services.

What operation would you use to convert a user's password into a master encryption key?

deriveKey with PBKDF2 parameters converts a password string into a strong CryptoKey.

What is the purpose of storing the master key in IndexedDB as non-extractable?

Non-extractable storage in IndexedDB persists keys securely without exposing raw bytes.

What happens to existing wrapped data keys when a user updates their password?

Data keys themselves don't change. They are unwrapped with old master key and re-wrapped with new one.

In an E2E encrypted notes app, who can see the plaintext content of a note?

Only users with the decryption key can read notes. The server never handles plaintext.

End-to-End Encryption in the Browser — System Design Concept

📚End-to-End Encryption in the BrowserPro

11 sections

~30 min total

45 quick quizzes

2 SD challenges linked

0 of 11 done·~30 min left

Concepts›End-to-End Encryption in the Browser›What is End-to-End Encryption in the Browser?

0 / 11

11 sections~30 min

What is End-to-End Encryption in the Browser?

Build secure end-to-end encrypted notes using Web Crypto API in the browser

Read

~3 min

⋯

Table of Contents

Roadmap of E2E encryption concepts from fundamentals through full system design

Read

~3 min

⋯

Why E2E Encryption in the Browser?

Server stores only ciphertext; plaintext encryption happens locally before transmission

ReadQuizCode

~3 min

⋯

Core Vocabulary

Essential cryptography terminology: plaintext, ciphertext, keys, salts, IVs, KDFs, and algorithms

ReadQuiz

~3 min

⋯

The Web Crypto API at a Glance

Browser-native async API via window.crypto.subtle for key generation, encryption, and wrapping

ReadQuizCode

~3 min

⋯

Password-Based Key Derivation: PBKDF2 → AES-GCM

Convert weak passwords to strong AES keys using slow iterated hashing with random salt

ReadQuizCode

~3 min

⋯

Per-Note Data Keys Wrapped with a Master Key

Each note encrypted with unique data key; master key wraps data keys for efficient password changes

ReadQuizCode

~3 min

⋯

Sharing: Re-wrapping Data Keys with RSA-OAEP

Share notes securely by wrapping per-note data keys with recipient's RSA public key

ReadQuizCode

~3 min

⋯

Non-Extractable CryptoKey Objects in IndexedDB

Persist keys across sessions in IndexedDB while preventing raw key bytes from leaving browser memory

ReadQuizCode

~3 min

⋯

Putting It All Together: System Design for E2E Encrypted Notes

Complete architecture integrating crypto, key storage, sync, and secure sharing into production app

ReadQuiz

~3 min

⋯

Practice test

45 questions

~15 min

🔒

Pro content

End-to-End Encryption in the Browser is a Pro concept. Upgrade to access full content, practice questions, and design challenges.

Upgrade to Pro →

Notes

🔍

Loading…