Skip to content
Share
Capsules
Sign in

Living technical overview

Open protocol. Opinionated official network.

Capsule defines the portable encrypted artifact. Capsule Trust Exchange (CTX) defines the authorization and key-release conversation. Share Capsules is the first official implementation, with a curated registry that decides which providers and brokers official tools will trust by default.

Experimental architecture — interfaces and implementation are evolving

System model

The protocol and the official network are separate layers.

A compatible ecosystem can implement Capsule, CTX, creator tooling, Viewers, providers, brokers, and its own trust list. The Share Capsules product adds an official creator and Viewer experience that uses a curated registry instead of blindly trusting arbitrary service URLs.

Capsule

A portable, signed artifact containing encrypted payload metadata, content-profile requirements, creator public policy, provider identity, broker identity, release handle, and integrity commitments.

CTX Protocol

The request/response protocol that lets a Viewer validate a Capsule, request policy evaluation, receive a short-lived authorization, and redeem it for a device-bound wrapped key.

Official Registry

The Share Capsules trust list for recognized CTX Providers and Key Brokers, including status, capabilities, keys, endpoints, and revocation/deprecation state.

Trusted Viewer

The official or compatible client that validates registry status, explains requirements, obtains consent, coordinates CTX, receives the wrapped key, and renders locally.

Protocol flow

The Host distributes bytes; the Viewer drives trust and key release.

  1. Fetch and verify Capsule

    The Viewer downloads the Capsule from any compatible Host, verifies manifest signature, content commitments, format version, cryptographic suite, content profile, policy digest, and declared provider/broker identities.

  2. Check registry recognition

    Official tools consult the Share Capsules registry before sending credentials, device proofs, authorization requests, tickets, or key-release requests to declared services.

  3. Explain policy and ask consent

    The Viewer presents the creator-signed trust policy and asks whether the visitor wants to disclose the evidence required for this exact opening.

  4. Evaluate policy

    The Trust Provider / CTX Provider evaluates only the requirements relevant to this Capsule, account, device, action, policy digest, and current enforcement state.

  5. Issue narrow authorization

    On success, the provider returns a short-lived, signed, broker-audience-bound authorization ticket for one exact Capsule payload request.

  6. Redeem with broker

    The Key Broker validates the ticket, enforces replay and limits, commits the release, and returns the content key wrapped to the registered Viewer agreement key.

  7. Decrypt and render locally

    The Viewer unwraps the content key locally and renders in its trusted viewing surface. The Host never receives the plaintext or content key.

Capsule bindings

The signed manifest fixes the security-critical wiring.

A Host can move or mirror a Capsule, but it cannot rewrite which policy, provider, broker, content profile, or payload commitments apply without invalidating the creator signature. That immutability is what lets the Viewer reject tampering before disclosure.

Creator authority

Creator signing key identity, public verification key, manifest signature, Capsule ID, revision, and canonical policy digest.

Content commitments

Payload descriptors, content-profile identifier and version, encryption suite, entry commitments, sizes, hashes, and authenticated-data bindings.

Trust path

CTX issuer/provider identity, accepted assertion issuers or trust providers, required policy predicates, consent requirements, time windows, and limits.

Key path

Key Broker identity, broker audience, release handle, payload key registration binding, and ticket redemption constraints.

Cryptography

Distinct keys, distinct purposes, no silent substitution.

  • Creator manifest signing

    Ed25519 signs the canonical manifest. The private key stays with creator-controlled tooling and does not move through the Host.

  • Payload encryption

    AES-256-GCM encrypts protected payloads with fresh content keys and nonces. The raw content key is registered with the selected broker, not embedded in the Capsule.

  • Viewer device proof

    A registered Ed25519 device key binds account/device requests so tickets cannot be redeemed by a random client.

  • Viewer key agreement

    A distinct X25519 agreement key receives HPKE-wrapped content keys bound to the Capsule, payload, ticket, and broker context.

  • CTX authorization ticket

    The provider signs short-lived tickets with a provider key, exact broker audience, replay identifier, action, policy digest, and device binding.

  • Registry and discovery keys

    Official tools must verify registry and service metadata freshness, signatures, transport security, status, and expected key material before interaction.

Share Capsules V1 operates the initial provider and broker, so V1 is not a claim of cryptographic zero access. The design still preserves separable roles, dedicated credentials, auditable contracts, and a migration path to independent providers or brokers.

Official registry

Recognition is a product security boundary, not protocol ownership.

A protocol-compatible provider or broker is not automatically trusted by official tools. The official registry lets Share Capsules choose which services its creator and Viewer tools will interact with by default.

Creation-time checks

Official creator tooling offers only recognized providers and brokers for the relevant content profile, policy type, and key-release profile.

Viewing-time checks

Official Viewers can refuse Capsules whose declared provider or broker is unknown, stale, suspended, deprecated, or revoked.

Revocation limits

The registry can stop official tools from future interaction, but it cannot force independent ecosystems offline or rewrite already-signed Capsules.

Trust and privacy

Policy predicates, not a universal trust score.

Creator-defined policy

The Capsule carries a signed trust policy chosen by the creator. A provider may deny or enforce stricter operational controls, but must not authorize under weaker requirements than the signed policy.

Viewer consent

The Viewer explains what evidence will be disclosed and lets the visitor decline. Declining may mean the Capsule cannot be opened.

Limited results

Creators receive policy results and safe aggregates, not raw account history, email, global identity, device secrets, or complete viewing behavior.

Contextual enforcement

Tickets, evidence, device state, time windows, content-key releases, and counters are scoped to the Capsule, revision, payload, action, account, and device.

V1 scope and limits

A focused proof, not universal content control.

  • Primary scenario: protected static content on an independently hosted page, opened through a trusted Viewer.
  • Official network: V1 recognizes the Share Capsules CTX Provider and Share Capsules Key Broker while keeping provider and broker identities explicit in the protocol.
  • Protection goal: raise the cost of anonymous bulk harvesting and make releases conditional, accountable, and revocable through official tools.
  • Not promised: perfect copy prevention, guaranteed humanity, one-human-one-account, moral trust, or protection from misuse by an authorized person.
  • Deferred: third-party service recognition criteria, additional content profiles, mobile/cross-browser Viewers, adaptive renditions, chunking, federation, and stronger optional personhood credentials.

Available now

Secure image sharing is ready to use.

Create an account, protect an image, publish the protected Capsule on your site, and let eligible viewers open it with the Share Capsules Viewer. The hosted Share Capsules services handle the account, access, and key-release steps for the supported V1 flow.

Protect images
Turn supported image files into protected Capsules that can be published on ordinary web pages.
Choose access rules
Use open access, date windows, opening limits, revocation, and trust checks depending on how you want the image to be shared.
Use the hosted service
You do not need to run your own servers for the supported flow. Share Capsules provides the account, access, and key-release services.
Still coming later
More content types, more browsers and devices, more provider choices, and more advanced publishing workflows.

Design sources

The detailed intent remains in living Markdown.

These are the source design documents behind this overview. Each link opens the corresponding Markdown file in the public project repository when a repository URL is configured.

Confirm this change

This action may not be reversible.