Skip to main content

Encrypt with HITE

HITE seals a payload with AES-256-GCM, binding it to the exact Zeqond it was sealed at — so the ciphertext carries when it was made, and opening it verifies both the tag and the tick. This guide seals a payload and opens it. You'll need a zeq_ak_… key from spinning up a machine.

1 — Seal it​

The response hands back the ciphertext, its IV, and the Zeqond it was sealed at:

curl -sX POST https://zeqsdk.com/api/hite/encrypt \
  -H "Authorization: Bearer $ZEQ_KEY" -H "Content-Type: application/json" \
  -d '{"plaintext":"the message"}'
# → { "ciphertext":"…", "iv":"…", "zeqond": 2296532592,
#     "algorithm":"AES-256-GCM", … }

The IV is load-bearing — it is the key material for that seal. Change a single character and the payload is permanently unrecoverable, by design. Add "kdf":"argon2id" for a stronger derivation.

2 — Open it​

HITE decrypts, verifies the GCM tag, and confirms the bound tick:

curl -sX POST https://zeqsdk.com/api/hite/decrypt \
  -H "Authorization: Bearer $ZEQ_KEY" -H "Content-Type: application/json" \
  -d '{"ciphertext":"…","iv":"…"}'
# → { "plaintext":"the message", "verified": true, "algorithm":"AES-256-GCM" }

3 — Optional: hide the seal inside a photo​

Because a seal is just bytes, the HITE Carrier can tuck it into a host photo or PDF — a JPEG APP15 marker, a PNG zeQc chunk — where every decoder already ignores it. The host stays a byte-valid, normally-openable file with no visible trace; the payload's presence is confirmed only by a successful decrypt. It's how you can hide your account equation in an image.

  • HITE encryption — the full primitive, TESC channels, and the Carrier.
  • ZeqID — carry your account equation as a sealed image or PDF.
  • Security — identity, encryption, and custody across the framework.