Resources · 6 guides
Encryption and Privacy in File Transfer
What end-to-end encryption protects, what it does not, and what a relay or server can still observe.
Last updated
About this topic
“Encrypted” can mean three different things for a file transfer: encrypted on the wire (TLS), encrypted on the provider's disks (server-side encryption), or encrypted so that only the two endpoints hold the keys (end-to-end encryption). Only the last one keeps the service operator out, and even then the operator usually still sees metadata.
These guides define the terms precisely, explain AES-256-GCM and key agreement, list what a relay can observe, and document the SRIFT design, including the attacks it does not defend against. For how a specific product handles your data, look for the same three questions: who generates the keys, where they are stored, and what the server sees.
Guides
- End-to-End Encryption vs TLS for File TransferWhat end-to-end encryption means for file transfer, how it differs from TLS in transit, and how to tell which one a service actually provides.
- How AES-256-GCM Works, and How Files Use ItAES-256-GCM explained: counter-mode encryption, the authentication tag, why nonces must never repeat, and how to encrypt a large file in chunks safely.
- Client-Side vs Server-Side Encryption, and Zero-KnowledgeWho holds the key decides who can read your files. Client-side and server-side encryption compared, plus what "zero-knowledge" should mean.
- What a File Transfer Relay Can Actually SeeEven with end-to-end encryption, a relay sees metadata: IP addresses, sizes and timing. A concrete inventory, using SRIFT as the worked example.
- SRIFT Security Architecture and Threat ModelHow SRIFT encrypts files, chat and quick-share links: key agreement, AES-256-GCM, what the servers see, and the attacks it does not stop.
How-to and product guides
Shorter pages that show how to do these tasks with SRIFT.