Storage Modes
Choose between encrypted and plain storage modes, with three encryption algorithms to fit your use case.
📂 Storage Modes
MothrBox offers flexible storage modes to match your security and performance requirements. Choose encrypted mode with one of three military-grade algorithms, or use plain mode for public data.
🔐 Encrypted Mode
Store data with end-to-end encryption before it leaves your machine. Choose from three battle-tested algorithms:
AES-256-GCM (Default)
Best for: General purpose, compliance requirements, large files
./mothrbox encrypt confidential.pdf "SecurePassword2024"
./mothrbox decrypt <blob-id> recovered.pdf "SecurePassword2024"
Features:
- ✅ Hardware-accelerated on Intel/AMD (AES-NI)
- ✅ Industry standard (Signal, WhatsApp, 1Password)
- ✅ NIST approved, FIPS 140-2 compliant
- ✅ Password-based authentication
- ✅ PBKDF2 key derivation (600,000 iterations)
Use Cases:
- Legal documents and contracts
- Healthcare records (HIPAA-compliant)
- Financial data and invoices
- Corporate confidential documents
- General-purpose secure storage
ChaCha20-Poly1305
Best for: Mobile devices, ARM processors, IoT devices
./mothrbox chacha-encrypt video.mp4 "MobilePass123"
./mothrbox chacha-decrypt <blob-id> video.mp4 "MobilePass123"
Features:
- ✅ Optimized for ARM/mobile processors
- ✅ Faster than AES without hardware acceleration
- ✅ Used in WireGuard, TLS 1.3
- ✅ Password-based authentication
- ✅ Constant-time implementation (timing attack resistant)
Use Cases:
- Mobile photo/video backups
- IoT sensor data storage
- Raspberry Pi applications
- Mobile app encrypted databases
- Performance-critical applications on ARM
ECC (Elliptic Curve Cryptography)
Best for: Secure sharing without password exchange, multi-recipient scenarios
# Generate keys (one-time)
./mothrbox keygen
# Encrypt with recipient's public key (NO PASSWORD!)
./mothrbox ecc-encrypt document.pdf recipient_public.key
# Decrypt with private key
./mothrbox ecc-decrypt <blob-id> document.pdf your_private.key
Features:
- ✅ NIST P-256 elliptic curve (NSA Suite B approved)
- ✅ No password sharing required
- ✅ Ephemeral ECDH (perfect forward secrecy)
- ✅ Hybrid encryption (ECC + AES-256-GCM internally)
- ✅ Key-based authentication
Use Cases:
- Secure document sharing across teams
- Multi-recipient encryption (encrypt once per recipient)
- Whistleblower protection systems
- Academic research data sharing
- Enterprise key management scenarios
- Token-gated content systems
📁 Plain Mode
Best for: Public data, media delivery, open-access content
Store data without encryption when confidentiality is not required. Ideal for:
- Public media files (images, videos)
- Open-source project assets
- Public documentation
- Non-sensitive metadata
- Content delivery networks (CDN-style usage)
# Upload without encryption (coming soon in CLI)
./mothrbox upload public_data.json
# Or use direct Walrus client
docker exec mothrbox_system bash -c "
deno run -A --env-file=mothrbox_ts/.env \
mothrbox_ts/src/walrus-cli.ts upload /app/data/public_file.jpg
"
⚠️ Warning: Plain mode stores data unencrypted. Anyone with the blob ID can access the content. Only use for truly public data.
Comparison Table
| Feature | AES-256-GCM | ChaCha20-Poly1305 | ECC P-256 | Plain Mode |
|---|---|---|---|---|
| Encryption | ✅ Yes | ✅ Yes | ✅ Yes | ❌ No |
| Speed | Very Fast (HW) | Fast (SW) | Moderate | Fastest |
| Hardware Accel | ✅ x86/x64 | ❌ No | ❌ No | N/A |
| Authentication | Password | Password | Key-based | None |
| Key Sharing | Password required | Password required | Public key only | Public blob ID |
| Multi-Recipient | Re-encrypt each | Re-encrypt each | ✅ Easy | N/A |
| Best Platform | Desktop/Server | Mobile/ARM | Any | Any |
| Use Case | General purpose | Performance | Sharing | Public data |
Choosing the Right Mode
Use Encrypted Mode When:
- ✅ Data contains personal information (PII)
- ✅ Compliance required (HIPAA, GDPR, SOC 2)
- ✅ Confidential business documents
- ✅ Financial or legal records
- ✅ Medical or identity information
- ✅ Trade secrets or intellectual property
- ✅ Private communications
- ✅ Any sensitive information
Use Plain Mode When:
- ✅ Content is already public
- ✅ Fast delivery is critical
- ✅ No privacy concerns
- ✅ Open-source project files
- ✅ Public media assets
- ✅ Non-sensitive metadata
Algorithm Selection Guide
Choose AES-256-GCM if:
- Running on desktop/server with Intel or AMD processor
- Need maximum compliance (NIST, FIPS)
- Default choice for most users
- Large files benefit from hardware acceleration
Choose ChaCha20-Poly1305 if:
- Running on mobile devices (iOS, Android)
- Using ARM processors (Raspberry Pi, Apple Silicon)
- IoT devices without AES hardware
- Performance matters and no hardware acceleration available
Choose ECC if:
- Sharing files with multiple recipients
- Want to avoid password exchange
- Need public key infrastructure (PKI)
- Enterprise key management
- Long-term storage with key rotation
Choose Plain Mode if:
- Content is intentionally public
- No security concerns
- Maximum speed required
Security Considerations
For Password-Based Modes (AES, ChaCha20):
Strong Passwords:
# Bad
./mothrbox encrypt file.pdf "password123"
# Good
./mothrbox encrypt file.pdf "Tr0ng!P@ssw0rd#2024$WithMixedCase"
# Best - generate random
PASSWORD=$(openssl rand -base64 32)
./mothrbox encrypt file.pdf "$PASSWORD"
Password Management:
- ✅ Use unique passwords per file
- ✅ Store in password manager (1Password, Bitwarden)
- ✅ Never share password with blob ID in same channel
- ✅ Write critical passwords in physical safe
Password Sharing:
# Channel 1 (Email/Slack): Share blob ID
# Channel 2 (Phone/Signal): Share password
For Key-Based Mode (ECC):
Private Key Protection:
- ✅ NEVER share private keys
- ✅ Store encrypted at rest
- ✅ Back up to secure location (encrypted USB, hardware wallet)
- ✅ Use different key pairs for different purposes
- ✅ Rotate keys periodically
Public Key Sharing:
- ✅ Share freely via email, GitHub, websites
- ✅ Public keys cannot decrypt - safe to distribute
- ✅ Consider key directory service for teams
Key Storage Best Practices:
# Encrypt private key at rest
gpg --symmetric --cipher-algo AES256 private.key
# Store in secure location
chmod 600 private.key
mv private.key ~/.ssh/mothrbox_private.key
# Back up encrypted
cp private.key.gpg /path/to/encrypted/backup/
For Plain Mode:
Remember:
- ❌ No encryption means anyone with blob ID can access
- ❌ Data visible on Walrus network
- ❌ Cannot be "made private" later
- ✅ Only use for truly public content
Migration Between Modes
Encrypted to Plain (Decrypt and Re-upload)
# Download and decrypt
./mothrbox decrypt <encrypted-blob-id> file.pdf "Password123"
# Re-upload as plain (if you really want to)
# Note: Use direct Walrus client for plain mode
⚠️ Warning: Once encrypted data is stored as plain, it cannot be "unshared". Only do this if content is truly meant to be public.
Plain to Encrypted (Download and Encrypt)
# Download plain file
docker exec mothrbox_system bash -c "
deno run -A --env-file=mothrbox_ts/.env \
mothrbox_ts/src/walrus-cli.ts download <plain-blob-id> /app/data/file.pdf
"
# Encrypt and re-upload
./mothrbox encrypt data/file.pdf "NewPassword123"
# Delete plain blob (optional, if you control it)
Between Encryption Algorithms
# Download with one algorithm
./mothrbox decrypt <aes-blob-id> file.pdf "AESPassword"
# Re-encrypt with another
./mothrbox chacha-encrypt data/file.pdf "ChaChaPassword"
# Or switch to ECC
./mothrbox ecc-encrypt data/file.pdf recipient_public.key
Performance Characteristics
Encryption/Decryption Speed
| Algorithm | 1MB File | 100MB File | 1GB File |
|---|---|---|---|
| AES-256-GCM* | ~2ms | ~200ms | ~2s |
| ChaCha20 | ~2.5ms | ~250ms | ~2.5s |
| ECC | ~20ms | ~2s | ~20s |
| Plain | 0ms | 0ms | 0ms |
*With AES-NI hardware acceleration
Storage Overhead
| Mode | Overhead per File |
|---|---|
| AES-256-GCM | +28 bytes |
| ChaCha20-Poly1305 | +44 bytes |
| ECC P-256 | +65 bytes |
| Plain | 0 bytes |
Compliance & Standards
AES-256-GCM
- ✅ NIST FIPS 140-2 validated
- ✅ PCI DSS compliant
- ✅ HIPAA compliant
- ✅ GDPR compliant
- ✅ SOC 2 Type II approved
ChaCha20-Poly1305
- ✅ IETF RFC 8439 standardized
- ✅ Modern cryptography approved
- ✅ Used in WireGuard VPN
- ✅ TLS 1.3 cipher suite
ECC P-256
- ✅ NIST approved curve
- ✅ NSA Suite B approved for TOP SECRET
- ✅ FIPS 186-4 compliant
- ✅ Used in Bitcoin, Ethereum
Examples by Use Case
Healthcare (HIPAA Compliance)
# Use AES-256-GCM for compliance
./mothrbox encrypt patient_records.pdf "MedicalPass2024"
Mobile App Backups
# Use ChaCha20 for better mobile performance
./mothrbox chacha-encrypt app_database.db "AppBackup2024"
Legal Document Sharing
# Use ECC to avoid password exchange
./mothrbox keygen # Client does this
./mothrbox ecc-encrypt contract.pdf client_public.key
# Share blob ID via email - client decrypts with their key
Public Blog Assets
# Use plain mode for public images
# Direct Walrus upload (no encryption)
docker exec mothrbox_system bash -c "
deno run -A --env-file=mothrbox_ts/.env \
mothrbox_ts/src/walrus-cli.ts upload /app/data/blog_image.jpg
"
Next Steps
- 📖 CLI Reference - Learn all encryption commands
- 🔐 Security Best Practices - Protect your data properly
- 🚀 Advanced Usage - Automation and batch operations
- 🏗️ Architecture - How encryption works under the hood
💡 Best Practice: Default to encrypted mode unless you have a specific reason to use plain mode. When in doubt, encrypt! 🔒