Security claims with edges.
What dove protects, what each component can observe, and where the guarantee depends on software, operator behavior, or recipient trust.
Full-mode guarantees
- File content is encrypted on the sender’s machine before upload.
- The content key or fragment secret is not sent in ordinary HTTP requests.
- AES-GCM authenticates each chunk; order, termination, and content are bound.
- The gate atomically enforces positive download budget and unexpired policy.
- Opening or previewing the HTML page does not consume a download.
- PIN guesses are checked online and lock after five failures.
- The default page decrypts on the recipient device.
What infrastructure can still observe
| Component | Can observe |
|---|---|
| Share origin / gate | Share ID, timing, IP/network metadata, ciphertext size, policy, submitted PIN, and access result. |
| DynamoDB | Policy fields, opaque encrypted metadata, PIN verifier, and failed-attempt count. |
| S3 | Ciphertext object, object size, and access timing. Full-mode object keys omit the plaintext filename. |
| Recipient device | The link, fragment secret, optional PIN, decrypted metadata, and plaintext after approval. |
Filename, sender name, and message are encrypted with a key derived separately from the fragment secret. Their ciphertext is stored in policy so the page can retrieve it without revealing those fields to the server.
What dove does not guarantee
- Simple mode is not zero-knowledge. Unless optional encryption is used, AWS and anyone with applicable bucket access can read the object.
- A recipient can copy plaintext. Download limits control gate releases; they cannot revoke bytes already decrypted or prevent screenshots and redistribution.
- An operator controls its share page. A maliciously modified page could transmit the fragment. The structural server-can’t-read claim assumes the audited default page or a customization that preserves its no-exfiltration contract.
- Endpoint compromise wins locally. Malware or a compromised browser/CLI can read secrets or plaintext on the sender or recipient device.
- Traffic metadata remains. Encryption does not hide object sizes, timing, IP addresses, or the fact that a share exists from all infrastructure.
- PINs are short. Their online safety comes from the gate lockout. The KDF adds offline resistance but does not turn a four-digit PIN into high entropy.
PIN construction
The client derives PBKDF2-HMAC-SHA256(PIN, fragment_secret) with 600,000 iterations. The gate stores SHA-256(share_id + ":" + PIN) and counts failed online guesses. A correct PIN is visible to the gate during verification, but the gate lacks the fragment secret needed to derive the content key.
Deliver the PIN over a separate channel. Sending link and PIN in the same message removes the intended two-channel property.
Install and release trust
dove.sh is the canonical install anchor. Releases publish SHA-256 checksums plus Sigstore certificate and signature artifacts tied to the public GitHub Actions release workflow. Inspect the installer and workflow before use. The default share page links back to dove.sh instead of embedding an operator-controlled install command.
Review and reporting
The implementation is open source under Apache-2.0. Review the CLI, core and gate, and GitHub security policy. If the repository does not yet publish a complete coordinated-disclosure policy, use GitHub’s private vulnerability reporting rather than a public issue.