CryptoLens @cryptolensfeed - Twitter Profile

Pinned Tweet

6 months ago

🔐 idOS Encryption Flows Personal Data End-to-End Encrypted by Design Overview idOS is built on one foundational principle: your data stays yours. All personal data stored in idOS is end-to-end encrypted using modern, proven cryptography so only the user or explicitly authorized third parties can ever decrypt it. At the core of idOS encryption is asymmetric cryptography, powered by NaCl/libsodium (Curve25519 + XSalsa20 + Poly1305 AEAD), a security standard endorsed by industry leaders like Latacora. 🔑 How Encryption Works in idOS Every idOS user has a public–private key pair. By default: ✔️ All data is encrypted using the user’s public key ✔️ Only the user can decrypt it using their private key ✔️ Third parties must be explicitly granted access While idOS allows non-encrypted data, this is strongly discouraged. 📍 When Does Encryption Happen? 1️⃣ During KYC / Credential Issuance Verification providers encrypt Verifiable Credentials before writing them to idOS. 2️⃣ When Users Add Data Data entered via the idOS Dashboard is encrypted automatically. 3️⃣ When Granting Third-Party Access User decrypts → re-encrypts with the requester’s public key → uploads back to idOS. Third parties can use idOS SDKs to encrypt data following the same cryptographic standards. 🧠 Cryptography Behind idOS idOS uses authenticated asymmetric encryption, ensuring: Confidentiality Integrity Authenticity It uses a hybrid ECIES scheme: x25519-xsalsa20-poly1305, implemented via TweetNaCl inside the idOS Enclave. In simple terms: Alice encrypts data for Bob using: Alice’s private key Bob’s public key A nonce A shared secret is generated using x25519 ECDH Message is encrypted via xsalsa20 A MAC is generated with poly1305 Bob performs the reverse process to decrypt the data. 🕵️‍♂️ Ephemeral Keys for Superior Security idOS adds an additional layer: Encryption is always performed using ephemeral private keys. This means: Even if an Issuer leaks its private key Credentials it encrypted earlier still cannot be decrypted Because each encryption used a unique, ephemeral key This design minimizes systemic risk and protects users. 🔐 Derived Key Generation idOS supports key derivation from user passwords or seeds. Process: User provides entropy (seed or password) scrypt-js derives a 32-byte encryption key Seed also generates an asymmetric keypair (x25519-xsalsa20-poly1305) idOS ID acts as a unique salt for each user Future upgrades: bip39 mnemonic support Secure. Deterministic. User-friendly. 🔄 Encryption Flow #1 Using Derived Keys User password → scrypt → encryption key Encryption key → asymmetric key pair Data is encrypted with the user’s public key Stored encrypted inside idOS Even if database access is compromised, data remains unreadable. 🔁 Encryption Flow #2 Encrypting Data for Third Parties User decrypts their own data Re-encrypts it using the third party's public key Uploads the re-encrypted credential Only the authorized recipient can decrypt it This avoids unnecessary data duplication while keeping full control with the user. 🛡 The Role of the idOS Enclave The idOS Enclave (TEE) introduces hardware-level security: It protects: Encryption keys Decryption processes Access control logic Sensitive cryptographic operations It strengthens: Protection against OS-level attacks Compliance with privacy regulations Security for high-value identity data Even without the enclave, idOS is fully secure. With it, security becomes enterprise-grade, tamper-resistant, and future-proof. 🔐 @idOS_network - Modern Cryptography for the Identity Layer of Web3 Strong encryption, user control, and a privacy-first architecture ensure that idOS sets the standard for secure, decentralized identity storage. @wallchain #idOS_network #idOS #Wallchain

CryptoLensFeed's tweet photo. 🔐 idOS Encryption Flows

Personal Data End-to-End Encrypted by Design

Overview

idOS is built on one foundational principle: your data stays yours.
All personal data stored in idOS is end-to-end encrypted using modern, proven cryptography so only the user or explicitly authorized third parties can ever decrypt it.

At the core of idOS encryption is asymmetric cryptography, powered by NaCl/libsodium (Curve25519 + XSalsa20 + Poly1305 AEAD), a security standard endorsed by industry leaders like Latacora.

🔑 How Encryption Works in idOS

Every idOS user has a public–private key pair.
By default:

✔️ All data is encrypted using the user’s public key
✔️ Only the user can decrypt it using their private key
✔️ Third parties must be explicitly granted access

While idOS allows non-encrypted data, this is strongly discouraged.

📍 When Does Encryption Happen?
1️⃣ During KYC / Credential Issuance

Verification providers encrypt Verifiable Credentials before writing them to idOS.

2️⃣ When Users Add Data

Data entered via the idOS Dashboard is encrypted automatically.

3️⃣ When Granting Third-Party Access

User decrypts → re-encrypts with the requester’s public key → uploads back to idOS.

Third parties can use idOS SDKs to encrypt data following the same cryptographic standards.

🧠 Cryptography Behind idOS

idOS uses authenticated asymmetric encryption, ensuring:

Confidentiality

Integrity

Authenticity

It uses a hybrid ECIES scheme: x25519-xsalsa20-poly1305, implemented via TweetNaCl inside the idOS Enclave.

In simple terms:

Alice encrypts data for Bob using:

Alice’s private key

Bob’s public key

A nonce

A shared secret is generated using x25519 ECDH

Message is encrypted via xsalsa20

A MAC is generated with poly1305

Bob performs the reverse process to decrypt the data.

🕵️‍♂️ Ephemeral Keys for Superior Security

idOS adds an additional layer:
Encryption is always performed using ephemeral private keys.

This means:

Even if an Issuer leaks its private key

Credentials it encrypted earlier still cannot be decrypted

Because each encryption used a unique, ephemeral key

This design minimizes systemic risk and protects users.

🔐 Derived Key Generation

idOS supports key derivation from user passwords or seeds.

Process:

User provides entropy (seed or password)

scrypt-js derives a 32-byte encryption key

Seed also generates an asymmetric keypair (x25519-xsalsa20-poly1305)

idOS ID acts as a unique salt for each user

Future upgrades: bip39 mnemonic support

Secure. Deterministic. User-friendly.

🔄 Encryption Flow #1
Using Derived Keys

User password → scrypt → encryption key

Encryption key → asymmetric key pair

Data is encrypted with the user’s public key

Stored encrypted inside idOS

Even if database access is compromised, data remains unreadable.

🔁 Encryption Flow #2
Encrypting Data for Third Parties

User decrypts their own data

Re-encrypts it using the third party's public key

Uploads the re-encrypted credential

Only the authorized recipient can decrypt it

This avoids unnecessary data duplication while keeping full control with the user.

🛡 The Role of the idOS Enclave

The idOS Enclave (TEE) introduces hardware-level security:

It protects:

Encryption keys

Decryption processes

Access control logic

Sensitive cryptographic operations

It strengthens:

Protection against OS-level attacks

Compliance with privacy regulations

Security for high-value identity data

Even without the enclave, idOS is fully secure.
With it, security becomes enterprise-grade, tamper-resistant, and future-proof.

🔐 @idOS_network - Modern Cryptography for the Identity Layer of Web3

Strong encryption, user control, and a privacy-first architecture ensure that idOS sets the standard for secure, decentralized identity storage.

@wallchain #idOS_network #idOS #Wallchain

0

1

0

62

CryptoLens

@CryptoLensFeed

Last Seen Users on Sotwe

Trends for you

Most Popular Users