Guides
Share with a wallet
Give one specific address access to a private file, with no link to leak. The key is sealed to their inbox and only their browser can open it.
Inbox keys
Polkadot wallets sign but don't decrypt, and sr25519 keys can't be used for key agreement from a browser extension. So each PotDrive user creates an X25519 inbox key on their device. The public half goes into the registry with setInboxKey. The private half stays in that browser. In the Drive this is Receive shared files under Shared with me.
Sealing
eph = x25519.randomPrivateKey()
shared = x25519(eph, recipientInboxPublicKey)
key = HKDF-SHA256(shared, salt = "PotDrive share v1", info = root, 32 bytes)
sealed = 0x01 ‖ x25519.pub(eph) ‖ iv ‖ AES-256-GCM(key, iv, fileKey, aad = root)The owner calls share(root, to, sealed). The contract checks ownership and emits Shared(root, from, to, sealedKey). The recipient's Drive reads Shared logs addressed to their mapped H160, opens each with their inbox key, and lists the files under Shared with me. Binding the root as AAD means a sealed key can't be replayed onto another file.