Building Keeva: Client-Side Encryption and Persistent Vault State with Tatum and Walrus Memory

During the Total Recall - Tatum × Walrus Memory Hackathon, a technical walkthrough was created of a credential vault named Keeva. Keeva focuses on client-side encryption and persistent vault state with the use of Sui Mainnet wallet, Walrus Memory for persistent storage, and Tatum for blockchain reads and transaction checks. The vault separates identity, encryption, storage, and blockchain reads, and does not treat "connected wallet" as a single permission that unlocks everything.

To encrypt data before it reaches Walrus Memory, Keeva uses the browser's Web Crypto API with AES-256-GCM for authenticated encryption, a fresh 96-bit IV for each operation, a 128-bit authentication tag, PBKDF2-SHA256 with 600,000 iterations, and a random 32-byte salt for key derivation. Non-extractable Web Crypto keys are used to ensure the security of the encrypted content and its associated context.

Keeva binds encrypted records to identifiers such as memory account, namespace, vault, credential, and revision to protect the whole credential.

Keeva also separates unlocking the saved gateway configuration from unlocking the encrypted vault. Wallet-protected gateway profiles allow each wallet to have its own encrypted configuration stored on the current device. The vault supports two unlock methods: passphrase-derived encryption accompanied by a fresh wallet authorization signature, and wallet-derived encryption. This separation ensures that unlocking the saved gateway configuration does not expose the vault's credentials.