Webdav PQC Sync

中文版 README

⚠️ v2.0.0 BREAKING CHANGE — Not backward compatible

v2.0.0 switches encryption from RSA 4096 (OpenPGP) to ML-KEM-768 (NIST FIPS 203 post-quantum).

Old keys, passphrase, and all previously encrypted remote data are INVALIDATED. After upgrading you must:

1. Generate a new key pair in settings (no passphrase required)
2. Delete old encrypted data on your WebDAV server (or start with an empty directory)

Key format changed from OpenPGP armor to base64. Settings field privateKey renamed to secretKey.

File content + filenames — both encrypted. The server sees only random garbage. ML-KEM-768 (FIPS 203) post-quantum key encapsulation + AES-256-GCM, end-to-end encrypted sync to any WebDAV.

🔬 Post-Quantum Encryption (ML-KEM-768)

This plugin uses ML-KEM-768 (formerly Kyber-768), the NIST FIPS 203 standard for post-quantum key encapsulation — the official replacement for RSA and ECC:

• Quantum-resistant — immune to Shor's algorithm, which breaks RSA/ECC once large-scale quantum computers arrive
• NIST Level 1 security — equivalent to AES-128, chosen by NIST after years of cryptanalysis
• 1088-byte ciphertext — each file's AES-256-GCM key is wrapped in a fresh ML-KEM encapsulation
• Pure JS — using @noble/post-quantum (~72 KB), no WASM, no native dependencies

How it works

Your file → AES-256-GCM encrypt(random key) → ciphertext
                                       ↑
                                ML-KEM-768.encapsulate(public key)
                                       ↑
                                Server's view:  [OBSYNC-K | 1088B CT | 12B IV | AES-GCM ciphertext]

Your secret key never leaves the device — only the public key is needed to encrypt. The server stores 1108 bytes of overhead per file (ML-KEM ciphertext + AES-IV), seeing only random binary.

Key Features

🔒 Full Encryption, Zero Trust for Cloud

Most sync solutions (Obsidian Sync, iCloud, Dropbox, etc.) rely on cloud-side trust — the provider can read your data. WebDAV PQC Sync uses end-to-end encryption. All encryption happens locally; only ciphertext is sent to WebDAV:

• ✅ Filenames are encrypted too — Not just file content: every folder and file name is independently encrypted with AES-256-GCM and Base64URL-encoded. The server sees only random strings and has no idea what files you're editing
• File content encryption — ML-KEM-768 (FIPS 203) key encapsulation + AES-256-GCM bulk encryption. The 32-byte shared secret from ML-KEM directly keys AES-256-GCM. Hardware-accelerated via Web Crypto API
• Post-quantum secure — ML-KEM-768 is the NIST-standardized replacement for RSA/ECC, resistant to Shor's algorithm attacks from quantum computers
• Directory structure hidden — The full folder hierarchy is mapped to an equal-depth encrypted path. The cloud cannot reconstruct your folder layout
• Secret key never uploaded — Your secret key stays in local Obsidian config. Only the public key is needed to encrypt uploads

Result: The WebDAV provider, network intermediaries, and anyone with server access see only encrypted binary blobs with random filenames. Zero content, zero titles, zero structure.

🔄 Bidirectional Sync

• ETag-based incremental sync — only transfers changed files
• Journal tracking — local changes are logged for crash-safe operation
• Automatic conflict detection — when a file changes both locally and remotely, a conflict copy is created (.conflicted.YYYY-MM-DD.md)
• Full sync of file/directory creates, modifies, renames, and deletes in both directions

⚡ Usage

🛡️ Security Design

⚙️ WebDAV Compatibility

Works with any standard WebDAV service:

• NextCloud / ownCloud
• Synology NAS
• Apache mod_dav
• Any WebDAV-capable cloud storage

Supports self-signed certificates (enable in settings).

🌐 Cloudflare Proxy Compatible — Uploads and downloads use chunked transfer with automatic 100MB file splitting. This avoids Cloudflare's 100MB upload limit and works reliably behind Cloudflare proxies, CDNs, and other reverse proxies that restrict request sizes. Both upload and download are fully chunked.

🔁 Chunked Transfer

Files over 90MB (configurable in Advanced settings) are automatically split into chunks for both upload and download:

• Upload: Uses the Nextcloud OC-Chunked protocol — chunks are uploaded individually, then assembled server-side
• Download: Uses HTTP Range requests — chunks are fetched in parallel (10MB per chunk) with per-chunk timeout (60s) and automatic retry (3 attempts)
• Status bar shows real-time chunk progress: Uploading notes.md (3/12 · file 5/18)
• Files under 5MB download as a single request for maximum speed

🚀 Quick Start

1. Install the plugin
2. Fill in WebDAV URL, username, and password in settings
3. Click Generate Key Pair to create your ML-KEM-768 keys
4. Click Sync Now to start encrypted sync

Migrating to a new device: Export the config (including keys) from the old device, import it on the new one, then use Restore from WebDAV.

Excluded Paths

Defaults to .obsidian/plugins/ and .trash/. Add more comma-separated path prefixes as needed.

Obsync Webdav PQC Sync gives you the convenience of WebDAV and self-hosted storage with the privacy of end-to-end post-quantum encryption. Your notes. Your eyes only.