actualNoteContentPart: ## Encryption Key Storage
  Each user's copy of the Note Key is encrypted using that user's Standard Key or Vault Key and a randomly generated Initialization Vector to produce a Standard Note Key or a Vault Note Key.
  A unique Initialization Vector is used for each combination of user and note.
  The encrypted Standard Note Key or Vault Note Key is stored in the database along with the Initialization Vector.
  The database server's storage is encrypted at rest with AES-256, [block-level storage encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) .
  
  Standard Encryption Key
  	The user's Standard Key is stored encrypted using AES-256-GCM with a randomly generated Initialization Vector
  	The key used to encrypt the user's Standard Key is not accessible to the database server
  
  Vault Encryption Key
  	A random 256-bit Vault Key Salt value is generated and stored in the database encrypted with AES-256-GCM using an encryption key that is not available to the database server and a randomly generated Initialization Vector
  	The Vault Password entered by the user and the Vault Key Salt are used with PBKDF2-HMAC-SHA256 to produce the 256-bit Vault Key
  	PBKDF2-HMAC-SHA256 is configured to use [100,000 rounds](https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40)  
  	A Vault Key Verifier is [stored on the server]() , allowing for a zero-knowledge proof to ensure that the same Vault Password is used for all Vault Notes
  
  ## Encryption Key Delivery
  The encrypted Note Key is delivered to the client application in the Encryption-Key response header for any request that responds with encrypted note data.
  	Since the Encryption-Key header value is the encrypted Note Key, clients may cache the response in less secure storage.
  ## 
  ## Sharing
  To access a note's content, a user needs the Note Key. When a note is shared by a source user with a target user, the following steps are taken on the server:
  	The source user's Standard Key is used to decrypt the source user's encrypted copy of the Note Key
  	The target user's Standard Key and a new randomly generated Initialization Vector are used to encrypt the Note Key
  	The encrypted Note Key and new Initialization Vector are stored in the database associated with the target user
  
  ## Public Notes
  To access a note's content, public notes need the Note Key. When a note is made public by a user, the following steps are taken on the server:
  	The user's Standard Key is used to decrypt the user's encrypted copy of the Note Key
  	The Note Key is encrypted using AES-256-CBC with a 256-bit key that the database server does not have access and a randomly generated Initialization Vector
  	The encrypted Note Key and Initialization Vector are stored in the database, associated with the public URL
  
  When a public note is viewed, the server performs the following process to deliver the decrypted content to the viewer:
  	The public note's encrypted Note Key is decrypted by the application server
  	The Note Key is used to decrypt the note content
  	The decrypted note content is delivered to the client application
processedNoteContent: ---
  title: Amplenote Security Design
  headers: ## Encryption Key Storage
  ---
  Encryption Key Storage
  Each user's copy of the Note Key is encrypted using that user's Standard Key or Vault Key and a randomly generated Initialization Vector to produce a Standard Note Key or a Vault Note Key.
  A unique Initialization Vector is used for each combination of user and note.
  The encrypted Standard Note Key or Vault Note Key is stored in the database along with the Initialization Vector.
  The database server's storage is encrypted at rest with AES-256, [block-level storage encryption](https://docs.aws.amazon.com)`
   . Standard Encryption Key
  The user's Standard Key is stored encrypted using AES-256-GCM with a randomly generated Initialization Vector
  The key used to encrypt the user's Standard Key is not accessible to the database server Vault Encryption Key
  A random 256-bit Vault Key Salt value is generated and stored in the database encrypted with AES-256-GCM using an encryption key that is not available to the database server and a randomly generated Initialization Vector
  The Vault Password entered by the user and the Vault Key Salt are used with PBKDF2-HMAC-SHA256 to produce the 256-bit Vault Key
  PBKDF2-HMAC-SHA256 is configured to use [100,000 rounds](https://gist.github.com)`
  
  A Vault Key Verifier is [stored on the server]()
   , allowing for a zero-knowledge proof to ensure that the same Vault Password is used for all Vault Notes 
  Encryption Key Delivery
  The encrypted Note Key is delivered to the client application in the Encryption-Key response header for any request that responds with encrypted note data.
  Since the Encryption-Key header value is the encrypted Note Key, clients may cache the response in less secure storage. 
  
  
  Sharing
  To access a note's content, a user needs the Note Key. When a note is shared by a source user with a target user, the following steps are taken on the server:
  The source user's Standard Key is used to decrypt the source user's encrypted copy of the Note Key
  The target user's Standard Key and a new randomly generated Initialization Vector are used to encrypt the Note Key
  The encrypted Note Key and new Initialization Vector are stored in the database associated with the target user 
  Public Notes
  To access a note's content, public notes need the Note Key. When a note is made public by a user, the following steps are taken on the server:
  The user's Standard Key is used to decrypt the user's encrypted copy of the Note Key
  The Note Key is encrypted using AES-256-CBC with a 256-bit key that the database server does not have access and a randomly generated Initialization Vector
  The encrypted Note Key and Initialization Vector are stored in the database, associated with the public URL When a public note is viewed, the server performs the following process to deliver the decrypted content to the viewer:
  The public note's encrypted Note Key is decrypted by the application server
  The Note Key is used to decrypt the note content
  The decrypted note content is delivered to the client application
noteTitle: Amplenote Security Design