@nodatachat/protect: NoData's verification layer

This package lets you check NoData's claims without trusting NoData. It does not run NoData, has no CLI for the product and makes no network calls. It holds the formats, their specs, test vectors, and the code that checks them. The code is shipped readable (not minified) because it is meant to be read.

Looking for the old protect CLI (init, encrypt, run)? It moved to @nodatachat/nodata: npm i -g @nodatachat/nodata.

What you can check today

"NoData holds only half a key" (split-key format v1)

An API key or a secret is split on your computer into two 1024-byte halves. NoData stores one; your computer keeps the other and joins them in memory.

• SPLIT-KEY-FORMAT.md: the whole format, what it proves and what it does not.

• dist/split-key.js: the implementation (about 70 lines). NoData's software runs this same module.

• Check that the code matches the published format:

  npx @nodatachat/protect@3 check-vectors

  It recomputes the vectors from the spec and prints PASS or FAIL. It needs nothing but Node.

What this proves: NoData's half is random bytes drawn apart from the value, so on its own it says nothing about the value, not even its length. What it does not prove on its own: that the software on your computer never also sends your half. You can watch that in the traffic: the only split material that leaves is the 1024-byte server half.

"Every decision leaves a proof you can check" (evidence pack format v1)

Every release, open, revoke or policy decision writes a signed receipt into a chain. An evidence pack is a JSON export of those receipts with their signatures and public keys.

• EVIDENCE-PACK-FORMAT.md: the format, the exact bytes each signature covers (Ed25519, and ML-DSA-65 for the quantum-resistant half), the seven checks, and what a pack does not prove.

• EVIDENCE-PACK-EXAMPLE.json: a complete pack signed with public test keys, so you can see every check pass and then break it.

• Verify a pack you were given, or the example:

  npx @nodatachat/protect@3 verify-pack pack.json

  It prints PASS or FAIL for each check and exits 0 only if all of them hold.

Coming next

Each release adds only what is needed to verify a claim NoData makes: the file-seal format next.

Requires Node 20.19 or later. The one dependency is @noble/post-quantum, for ML-DSA-65, which Node does not provide.

License

FSL-1.1-ALv2. See LICENSE.md. You may read, run and verify freely.