> For the complete documentation index, see [llms.txt](https://wiki.4thtech.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.4thtech.io/occ-v1/encryption.md).

# Encryption options

OCC v1 offers three encryption options: custom, AES with a random key, and AES with a key from ECDH.

{% hint style="warning" %}
**Status: Legacy (reference).** OCC v1 is the first-generation 4thTech protocol. It is documented for existing integrations and as reference; new agent-to-agent work uses OCC v2 ([AgentLink](/agentlink/agentlink.md)).
{% endhint %}

Encryption happens in the sender's app before anything is stored or recorded. OCC v1 offers three options.

| Option        | How the key is made                                             | When to use it                           |
| ------------- | --------------------------------------------------------------- | ---------------------------------------- |
| Custom        | The integrator supplies its own implementation                  | You have specific requirements           |
| AES           | A random (or imported) secret key; AES-256-GCM                  | Simple cases                             |
| AES with ECDH | A shared secret from Elliptic-Curve Diffie-Hellman; AES-256-GCM | Sender and receiver each hold a key pair |

## AES with ECDH

The receiver's public encryption key must be recorded on chain (in the user contract). The sender combines it with their own private key to compute a shared secret, which is the AES key. The receiver does the same in reverse. The [Encryptor extension](/encryptor/encryptor.md) holds the private key and computes the shared secret, so the app never sees the private key.

```mermaid
flowchart LR
    subgraph Sender
      SP["Sender key pair (in Encryptor)"]
    end
    subgraph Receiver
      RP["Receiver key pair (in Encryptor)"]
    end
    Chain["User contract: public keys"]
    RP -- "publishes public key" --> Chain
    Chain -- "public key" --> SP
    SP -- "shared secret (ECDH)" --> AES["AES-256-GCM key"]
    RP -- "same shared secret" --> AES
    AES --> Ct["Encrypted content"]
```

*Figure: The public key is shared on chain, private keys stay in Encryptor, and both sides derive the same AES key.*

## Chat

One-to-one chat messages use AES with ECDH, like mail. In a group chat, a conversation key is encrypted separately for each member, so adding a member means encrypting the key for them. See [Message flows](/occ-v1/message-flows.md).

## Not your keys, not your messages

If you lose your private key, nobody can decrypt your content. Back up your key as described in the [Encryptor manual](/encryptor/encryptor.md).