> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blindcast.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Zero-Knowledge Explained

> What 'zero-knowledge' means in the context of BlindCast: the server stores only opaque encrypted bytes and never has access to your video content.

"Zero-knowledge" describes a specific trust property: **the server that stores your video cannot read it**. It holds encrypted bytes — ciphertext — but never the key needed to decrypt them. Only the creator and authorized viewers hold keys.

## The trust boundary

Every component in a BlindCast deployment sits on one side of a trust boundary:

```mermaid theme={null}
flowchart LR
  subgraph trusted_creator["Creator's client (trusted)"]
    C["Encrypt video<br/>AES-128-CBC"]
  end

  subgraph untrusted["Untrusted zone"]
    K["Key server<br/>holds master key<br/>derives content keys"]
    S["S3 / CDN<br/>stores ciphertext only"]
  end

  subgraph trusted_viewer["Viewer's client (trusted)"]
    V["Decrypt segments<br/>in browser"]
  end

  C -- "encrypted bytes" --> S
  C -- "derives content key via HKDF" --> K
  V -- "fetch content key" --> K
  S -- "serve encrypted segments" --> V
  K -- "return derived key" --> V
  V -- "AES-128-CBC decrypt" --> V
```

| Component         | Trust level       | What it sees                                     |
| ----------------- | ----------------- | ------------------------------------------------ |
| Creator's browser | Trusted           | Plaintext video + keys                           |
| Viewer's browser  | Trusted           | Plaintext video after decryption                 |
| Key server        | Partially trusted | Master key, derived keys — never plaintext video |
| S3 / CDN          | Untrusted         | Encrypted bytes only                             |

## What "zero-knowledge" means here — and what it doesn't

BlindCast's zero-knowledge property is about the **storage layer**, not the key server:

* **S3 / CDN cannot read your video.** They store ciphertext. Without the content key, the bytes are meaningless.
* **The key server does hold the master key.** It derives per-content keys on demand via HKDF. You must trust and secure your key server.

<Warning>
  BlindCast is not end-to-end encrypted in the Signal/WhatsApp sense. The key server is a trusted intermediary — it can issue keys to any viewer who passes authentication. If the key server is compromised, content keys can be obtained.

  Zero-knowledge here means your **storage provider** (S3, CDN) learns nothing about your content.
</Warning>

## How encryption works

BlindCast uses the **HLS encryption model** (RFC 8216 §4.3.2.4):

1. Each video is split into short `.ts` segments by an HLS packager (e.g. FFmpeg).
2. Each segment is encrypted with **AES-128-CBC** using a **per-content key** derived from the master key via HKDF.
3. The HLS manifest (`.m3u8`) is rewritten to include `EXT-X-KEY` tags pointing at the BlindCast key server.
4. At playback, the browser fetches segments from S3/CDN and requests the content key from the key server.
5. The browser decrypts each segment locally using the Web Crypto API before handing frames to the video element.

The plaintext segment data **never leaves the browser** during playback.

## Key derivation: why it matters

BlindCast doesn't store one key per video. It stores one **master key** and derives content-specific keys on demand via HKDF (HMAC-based Key Derivation Function, RFC 5869):

```
Master Key + Salt  →  HKDF  →  Content Key (per contentId)
Content Key        →  HKDF  →  Segment Key (per epoch, for rotation)
```

This means:

* Rotating access for a specific video requires only invalidating or revoking the lease for that content ID — not re-encrypting the video.
* Adding a new video doesn't require generating or storing a new root key.
* The master key can be stored in a secret manager; derived keys are computed at request time.

See [Architecture Overview](/introduction/architecture-overview) for the full key hierarchy and how derivation fits into the system.