Encrypt and publish IPFS assets backed by TrustToken payments.
Files stay private until you re-sign the authorization message. The desk handles AES-256-GCM encryption, optional fee payments, ciphertext authorization, and recovery bundles.
Workflow overview
- 1. Sign locally to derive the encryption key. This signature is never uploaded or saved.
- 2. Select a file, encrypt locally, and create a SHA-256 proof of the ciphertext.
- 3. Pay with TrustToken (TT) when enabled, then sign a separate no-gas publish authorization.
- 4. Upload only the encrypted payload and download the recovery JSON for safekeeping.
Bundle includes CID, IV, encryption timestamp, ciphertext digest, and optional payment proof. It never contains your encryption signature.
Storage readiness
DIDLab secure storage path
Plaintext stays in your browser. A separate wallet signature authorizes only the encrypted payload sent to the DIDLab IPFS gateway.
AES-256-GCM
Pending
Signed ciphertext proof
1. Authorize your wallet
Sign a no-gas message to unlock encryption locally. The encryption signature is never uploaded or stored. Each authorization expires after 300 seconds.
- Wallet
- Not connected
- Authorized at
- —
2. Upload & encrypt your file
We encrypt your file locally with AES-256-GCM before streaming it to ipfs.didlab.org.
4. Save the decryption details
Save the CID, IV, encryption timestamp, ciphertext digest, and wallet address. The recovery bundle intentionally excludes the encryption signature.
5. Decrypt a file
Fetch the encrypted blob from the gateway, re-sign the original timestamp, and decrypt locally.
Why encrypt before IPFS?
Public IPFS nodes serve any CID. DIDLab encrypts before upload, uses an opaque payload name, and requires a wallet-signed ciphertext authorization at the portal gateway. The encryption signature stays local and is never placed in the recovery bundle.
Course badges and NFTs
Upload artwork and metadata JSON here, then store the encrypted CID in DIDLabBadges or related contracts.
Project documentation
Encrypt lab notebooks, demos, or analytics exports before sharing with reviewers. Include IV/timestamp in your README.
Healthcare & privacy apps
Students can encrypt raw data off-chain and only expose hashes/CIDs on-chain, meeting privacy constraints.
Quick decrypt script
import { ethers } from "ethers";
import fs from "fs";
import { createDecipheriv } from "crypto";
const walletAddress = "0xYourAddress";
const timestamp = 1738881234; // saved from upload
const message = "Authorize DIDLab IPFS upload
Address:" + walletAddress + "
Timestamp:" + timestamp;
const signature = await signer.signMessage(message);
const keyMaterial = ethers.getBytes(ethers.keccak256(ethers.getBytes(signature)));
const iv = Buffer.from("BASE64_IV", "base64");
const cipher = fs.readFileSync("encrypted.bin");
const decipher = createDecipheriv("aes-256-gcm", Buffer.from(keyMaterial), iv);
const plaintext = Buffer.concat([decipher.update(cipher), decipher.final()]);
fs.writeFileSync("decrypted.bin", plaintext);