Cache: Encrypted Local Message Cache

The Problem

Local caches store sensitive data in plaintext IndexedDB. Browser data is accessible to extensions, XSS attacks, and anyone with local access to the device.

IndexedDB is the standard client-side storage for web and desktop applications. But it stores data as plain JSON objects with no encryption layer. Any browser extension with storage permissions can read the entire database. A single XSS vulnerability exposes every cached message.

Existing solutions either skip local caching entirely (sacrificing offline access and performance) or store plaintext and hope the OS protects it. Neither approach is acceptable for sensitive communications.

The Old Way

The PRIVATE.ME Solution

Every cache entry is encrypted with AES-256-GCM before it touches IndexedDB. Keys are derived via PBKDF2 with 600,000 iterations from the user's primary email. No plaintext is ever stored at rest.

The cache operates as a transparent encryption layer. Application code calls createCache and getCached with the same API as a plain key-value store. Encryption and decryption happen automatically. Corrupted entries are detected via GCM authentication tags and auto-deleted on read.

LRU eviction keeps memory bounded. TTL expiry ensures stale entries are purged. The cache is fully resumable across app restarts with no re-initialization penalty.

The New Way

How It Works

A three-layer architecture: key derivation, transparent encrypt/decrypt, and self-healing storage with automatic eviction.

Use Cases

Integration

import { createCache, getCached } from '@private.me/cache';

// Initialize encrypted cache from user's primary email
const cache = await createCache('user@example.com', {
  maxEntries: 5000,
  ttlMs: 86400000,        // 24 hours
  evictionPolicy: 'lru'
});

// Store — automatically encrypted with AES-256-GCM
await cache.set('msg:abc123', messageData);

// Retrieve — decrypted transparently, corrupt entries auto-deleted
const message = await getCached(cache, 'msg:abc123');

Security Properties

Ship Proofs, Not Source

Cache generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases