The hybrid post-quantum stack
ArShield is deliberately conservative: instead of betting on a single post-quantum algorithm, it pairs each new primitive with a battle-tested classical one and combines them in the browser.
The encryption pipeline
Hybrid key agreement
ArShield combines ML-KEM-768 (Kyber) with X25519. The shared secret is only as weak as the stronger of the two, so an attacker must break both a lattice scheme and an elliptic-curve scheme to recover a key.
AEAD content encryption
File content is encrypted with AES-256-GCM using the derived key. A fresh random 96-bit nonce is generated per file, and the algorithm header is passed as additional authenticated data, so any edit to the header or ciphertext is detected on decrypt.
Post-quantum signature
The envelope — header plus ciphertext — is signed with ML-DSA-65 (Dilithium) under a fixed ArShield context. The signature covers the KEM ciphertexts, the nonce and the encrypted payload, so a modified byte fails verification before decryption.
Browser-only execution
All primitives run in pure JavaScript in your browser, using the audited @noble libraries. No key material, plaintext, or filename is ever posted to a server. There is no server that could receive it.
The .arshield container
A .arshield file is a small JSON envelope that travels next to your encrypted payload. It carries the algorithm identifiers, the wrapped content key, the sender and recipient wallet addresses, the ML-DSA-65 signature, and an optional x402 receipt. It contains no plaintext and no unencrypted key material.
The envelope is self-describing, so a recipient only needs their own key material to open it. Nothing about the container depends on ArShield infrastructure being online.
Wallet-derived identity
Rather than asking you to create an account, ArShield treats your wallet as your identity. On first use you sign a fixed, human-readable message. That signature derives a deterministic identity key pair which is never transmitted anywhere. A later sign-in reproduces the same identity, so the wallet itself is the only credential you need to remember.
This is why losing your wallet, key file, and passphrase means your files are unrecoverable: there is no recovery authority, and no escrow, because there is no server holding a copy.