Roadmap

[franky47]

Documentation

• General
  • Add list of goals and non-goals for the project
  • Identify use-cases and non-use cases
  • Identify threat models (based on who they apply to: end-users, application developers, e2esdk developers)
• Cryptography
  • Encodings
  • Signatures
  • Identity
  • Public key authentication
  • Cipher suite
  • Keychain items
  • Sharing
  • Form data handling
• Components
  • Server
    • Swagger/OpenAPI docs (Add Swagger/OpenAPI server API docs #12)
    • How to deploy the Docker image
  • Client ([docs] document client API #20)
  • Devtools

Cryptography

• Password derivation (Argon2id) for authentication ([devtools] login with invalid creds #19)
• Secret splitting (Shamir Secret Sharing) for recovery
• PAKE for online authentication (OPAQUE)
• Form data handling
• Separate Consolidate cryptographic layer:
  • @e2esdk/crypto-core for common code (codecs, utils)
  • @e2esdk/crypto-lite for TweetNaCl-based ingestion operations (sealed box, secret box)
  • @e2esdk/crypto-sodium for complete Sodium-based operations
  • @e2esdk/crypto-forms for higher-level form data encryption
    Note: it is preferable to focus on a single ciphersuite to avoid rolling out missing algorithms on a "lite" version that will only save a few KiB. So everything should be part of a single cryptographic library.

Client

• Real-time notifications via WebSocket + SharedWorker, gracefully degraded to polling where SW aren't available. (Realtime notifications with websockets #8)
• Configure persistance ("remember me for N days")

Server

• Add audit logs

Devtools

• Investigate passing a live Client as "props" rather than creating a dedicated one
• Fix usage in SSR frameworks (Next.js)
• Allow configuring position & size, for static panel vs drawer behaviour

Examples

• Add contact form example from https://github.com/SocialGouv/chiffrement-sandbox

Other

• Add CI
• Investigate Changesets for versioning packages -> Using semantic release instead
• Investigate Verdaccio for local NPM deployment testing (Add Verdaccio to test package publishing #11)
• Deploy to SocialGouv's internal NPM registry for testing -> deployed to public NPM registry, under the @socialgouv organisation
• Deploy Docker image to SocialGouv's container registry
• Add CD