{
  "id": 19327067,
  "title": "Building Keeva: Client-Side Encryption and Persistent Vault State with Tatum and Walrus Memory",
  "url": "https://urgent.news/2026/11/10/building-keeva-client-side-encryption-and-persistent-vault-state-with",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T11:46:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/notg0d/building-keeva-client-side-encryption-and-persistent-vault-state-with-tatum-and-walrus-memory-2i2f"
  },
  "original_language": "en",
  "account": "During the Total Recall - Tatum × Walrus Memory Hackathon, a technical walkthrough was created of a credential vault named Keeva. Keeva focuses on client-side encryption and persistent vault state with the use of Sui Mainnet wallet, Walrus Memory for persistent storage, and Tatum for blockchain reads and transaction checks. The vault separates identity, encryption, storage, and blockchain reads, and does not treat \"connected wallet\" as a single permission that unlocks everything.\n\nTo encrypt data before it reaches Walrus Memory, Keeva uses the browser's Web Crypto API with AES-256-GCM for authenticated encryption, a fresh 96-bit IV for each operation, a 128-bit authentication tag, PBKDF2-SHA256 with 600,000 iterations, and a random 32-byte salt for key derivation. Non-extractable Web Crypto keys are used to ensure the security of the encrypted content and its associated context. Keeva binds encrypted records to identifiers such as memory account, namespace, vault, credential, and revision to protect the whole credential.\n\nKeeva also separates unlocking the saved gateway configuration from unlocking the encrypted vault. Wallet-protected gateway profiles allow each wallet to have its own encrypted configuration stored on the current device. The vault supports two unlock methods: passphrase-derived encryption accompanied by a fresh wallet authorization signature, and wallet-derived encryption. This separation ensures that unlocking the saved gateway configuration does not expose the vault's credentials.",
  "summary": "A technical walkthrough of a credential vault built for the Total Recall - Tatum × Walrus Memory Hackathon. Remembering a user is not the same as securely restoring their private data. For a credential vault, persistence raises several difficult questions: Where does encryption happen? What authorizes access? How does the application identify the correct vault after a wallet reconnects? What…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}