Getting started
Installation
Install
Download the signed MSIX package and double-click to install. Windows will verify the package signature before installation. Requires Windows 11 22H2+ and the .NET 8 Desktop Runtime.
Download ntkDesktop.msix# Alternatively, install via winget winget install ntkDesktop
Configure
Open ntkDesktop and add a cloud provider. Enter your bucket name, region, and credentials. The sync root will appear in Windows Explorer once the provider is validated.
# Example: S3 provider configuration provider: s3 bucket: my-encrypted-bucket region: us-east-1 access_key: [stored in Windows Credential Manager] dispersal: 3-of-5 # k-of-n IDA sharding
Enroll
Device enrollment generates a keypair on the local machine and registers the device with your policy server. After enrollment, ntkDesktop will request a DPoP-bound access token for each sync session.
# Enrollment flow 1. Generate device keypair (stored in DPAPI-protected store) 2. Submit CSR to enrollment endpoint 3. Receive signed device certificate 4. Fetch initial DPoP-bound access token 5. Ready — sync root active in Windows Explorer
Architecture
How it works.
Four subsystems cooperate to deliver encrypted, policy-gated sync. Each is independently documented in the security reference.
Crypto
Envelope Encryption
AES-256-GCM streaming AEAD. Per-file keys derived from device master key. 4096-byte segment alignment. Keys never leave the device.
Encryption specDispersal
IDA Shard Dispersal
Rabin IDA over GF(2^8). k-of-n configurable. Each shard independently authenticated. Manifest sidecar binds shard order and key material.
Dispersal specPolicy
dABAC Evaluation
AND-of-OR attribute policy. Evaluated locally per file operation. Unknown attribute → deny. No server round-trip required.
Policy specAuth
Device Binding
DPoP-bound tokens tied to device keypair. Stolen tokens cannot be replayed from another device. JWKS rotation with background refresh.
Device binding specTroubleshooting