Counsel

Legal case management systems store highly sensitive attorney-client privileged data, yet most platforms trust the server with plaintext access, creating a single point of compromise.

Engineered a zero-trust architecture where the server never accesses plaintext case details. Implemented RSA (2048-bit), ECC (secp256k1), PBKDF2, HMAC-SHA256, and AES-256-GCM entirely from scratch in TypeScript, without third-party crypto libraries.

• 01Implemented RSA-2048, ECC (secp256k1), PBKDF2, HMAC-SHA256, AES-256-GCM from scratch in TypeScript
• 02Secured case data and PII with AES-256-GCM, encapsulating AES keys via RSA public keys
• 03PBKDF2 with 10,000 HMAC-SHA256 iterations for salted passwords + email-based TOTP for 2FA
• 04HMAC signatures on database records to verify integrity and block unauthorized modification
• 05ECDSA-signed JWTs in HttpOnly, SameSite=Strict cookies with RBAC across Clients, Lawyers, and Admins

• →Complete end-to-end encryption — server has zero access to plaintext data
• →Three-tier role-based access control system
• →Mathematical data integrity verification via HMAC
• →Secure session management with ECDSA-signed JWTs

Building cryptographic primitives from scratch deepened understanding of security foundations far beyond using libraries. The trade-off between performance and security at every layer was a constant design consideration.