You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[View this sample's code on GitHub](https://github.com/dfinity/examples/tree/master/motoko/vetkeys/encrypted_notes_app_vetkd)
4
+
5
+
Also available in: [Rust](../../../rust/vetkeys/encrypted_notes_app_vetkd)
6
+
7
+
Encrypted notes is an example app for authoring and storing confidential information on the Internet Computer (ICP) in the form of short pieces of text. Users can create and access their notes via any number of automatically synchronized devices authenticated via Internet Identity (II). Notes are stored confidentially using vetKeys. The end-to-end encryption is performed by the app's frontend.
8
+
9
+
In particular, the notes are encrypted with an AES key that is derived (directly in the browser) from a note-ID-specific vetKey obtained from the backend canister (in encrypted form, using an ephemeral transport key), which itself obtains it from the vetKD system API. This way, there is no need for any device management in the app, plus sharing of notes becomes possible.
10
+
11
+
The vetKey used to encrypt and decrypt a note is note-ID-specific (and not, for example, principal-specific) to enable the sharing of notes between users. The derived AES keys are stored as non-extractable CryptoKeys in an IndexedDB in the browser for efficiency so that their respective vetKey only has to be fetched from the server once.
cd examples/motoko/vetkeys/encrypted_notes_app_vetkd
26
+
```
27
+
28
+
### Deploy
29
+
30
+
```bash
31
+
icp network start -d
32
+
icp deploy
33
+
```
34
+
35
+
Open the frontend URL printed by `icp deploy`.
36
+
37
+
To run the frontend in development mode with hot reloading (after `icp deploy`):
38
+
39
+
```bash
40
+
npm run dev
41
+
```
42
+
43
+
When done, stop the local network to free up the port for other projects:
44
+
45
+
```bash
46
+
icp network stop
47
+
```
48
+
49
+
## Example components
50
+
51
+
### Backend (`backend/`)
52
+
53
+
A single Motoko canister that stores encrypted notes. It is deployed automatically with `icp deploy`.
54
+
55
+
### Frontend (`frontend/`)
56
+
57
+
A **Svelte** application providing a user-friendly interface for managing encrypted notes. Canister bindings are generated from `backend/backend.did` at build time by the `@icp-sdk/bindgen` Vite plugin.
58
+
59
+
## Limitations
60
+
61
+
This example app does not implement key rotation, which is strongly recommended in a production environment.
62
+
63
+
## Troubleshooting
64
+
65
+
If you run into issues, clearing all the application-specific IndexedDBs in the browser might help. For example in Chrome, go to Inspect → Application → Local Storage → Clear All, and then reload.
66
+
67
+
## API level
68
+
69
+
This example intentionally uses the **raw vetKD management canister API** (`encryptedSymmetricKeyForNote`, `symmetricKeyVerificationKeyForNote`) to demonstrate how vetKD works at the protocol level.
70
+
71
+
For most applications, the higher-level [`EncryptedMaps`](https://github.com/dfinity/vetkeys/tree/main/frontend/ic_vetkeys/src/encrypted_maps) abstraction from `@icp-sdk/vetkeys` is the recommended approach — it handles key derivation, caching, and access control internally without requiring a custom crypto layer. See the **VetKD Password Manager** ([`../password_manager`](../password_manager)) and **Password Manager with Metadata** ([`../password_manager_with_metadata`](../password_manager_with_metadata)) examples for how `EncryptedMaps` is used in practice.
72
+
73
+
## Additional resources
74
+
75
+
-**[What are VetKeys](https://docs.internetcomputer.org/concepts/vetkeys)** — more information about VetKeys and VetKD.
76
+
-[Security checklist for this example](security-checklist.md)
77
+
-[Security best practices](https://docs.internetcomputer.org/guides/security/overview/)
0 commit comments