Lain Vault: Recursive Cryptographic API
A RESTful API engineered for recursive directory encryption, providing absolute payload and metadata obfuscation via AES-256 CBC.
Tech stack
- Languages
- Frameworks & libraries
- Tools
Performance & metrics
- Rapid in-memory cryptographic transformations executed by buffering entire file payloads directly into RAM prior to cipher application
- Deterministic, synchronous filesystem traversal leveraging ASP.NET Core's threaded request handling
Why I built it
Standard encryption utilities typically leave filesystem metadata (filenames, extensions, and directory topologies) exposed, which can leak critical contextual information. I engineered this API to provide absolute deniability. By recursively traversing a target path and applying cryptographic mutations to both the file payloads and the structural metadata, the system leaves zero trace of the original context.
Architecture & decisions
Built on ASP.NET Core, the API exposes /encrypt and /decrypt endpoints receiving JSON payloads (target paths, exclusions, raw keys/IVs). The cryptographic engine utilizes the Aes class configured for Cipher Block Chaining (CBC) with PKCS7 padding. To enforce strict block cipher constraints, raw keys and IVs are forcefully resized to 32 bytes (256-bit) and 16 bytes (128-bit) respectively via Array.Resize. File payloads are read entirely into memory (ReadAllBytes) and mutated via CryptoStream over a MemoryStream. Metadata obfuscation is achieved by encrypting directory and file names, encoding them to Base64, and sanitizing the output for filesystem compatibility (replacing / and +).
Key features
- 01Military-grade AES-256 CBC payload encryption utilizing PKCS7 block padding
- 02Complete topological obfuscation: recursive encryption of all filenames and directory structures into sanitized, URL-safe Base64 strings
- 03Dynamic Key/IV length enforcement to prevent cryptographic runtime exceptions during API invocations
- 04Configurable file exclusion arrays to prevent locking critical system or application files during traversal
Technical review
Note: Due to the dual-use nature of recursive filesystem encryption APIs (i.e., operational similarities to ransomware execution topologies), the source code is kept strictly private and is available for demonstration upon request only.
Related projects
Lain's Vault: Encrypted Workspace
A secure, multi-user desktop vault for encrypted file management and native Markdown editing. Files and folders are encrypted with AES-256 (CBC mode) behind a double-key system — down to their very file names.
- Rust
- TypeScript
- C#
- +7
AES Visual Encryptor
A specialized cryptographic tool that serializes raw image data into encrypted binary (`.bin`) files to prevent metadata scraping and unauthorized access.
- Python
- Cryptography (Fernet)
- Pillow (PIL)
Informer Retribution System
An aggressive API-abuse script written in Rust, designed to flood malicious endpoints (such as exposed keylogger webhooks) with continuous, randomized payload loops.
- Rust
- HTTP APIs
Need something similar?
I can build a system like this for you, too.
Describe your project in a few sentences, and we'll work out the right approach and an estimated scope together.