APEX Protocol

Asymmetric Protection with Ephemeral X-keys.

End-to-end encryption for every API request between your frontend and backend — transparent, lightweight, and production-ready.

What is APEX?

APEX is an open-source end-to-end encryption protocol designed specifically for web applications. It secures every API request and response between a React frontend and a Spring Boot backend using elliptic curve key exchange (ECDH), AES-256-GCM authenticated encryption, and sequence-based replay protection.

Crucially, APEX sits invisibly between your frontend fetch calls and your backend endpoints — it requires zero changes to your existing controllers, routes, or business logic.

Architecture & layer arrangement

1

Frontend Interceptor Layer

The APEX client automatically wraps outgoing requests, encrypting the payload and appending sequence numbers before it hits the network.

2

Transport Layer (TLS)

The payload travels over standard HTTPS. Even if the TLS tunnel is terminated at a load balancer, the APEX payload remains encrypted.

3

Backend Filter Layer

The ApexFilter intercepts the request before it reaches Spring controllers — verifying the auth tag, checking for replay attacks, decrypting the body, and forwarding the raw request to your business logic.

How it works

Phase 1

The Handshake

A one-time operation per session that establishes shared encryption keys without transmitting them over the network.

  • Client and server generate ephemeral ECDH (P-256) key pairs.
  • They exchange public keys and random nonces.
  • Both independently compute a shared secret using ECDH mathematics.
  • HKDF-SHA256 derives the final enc_key (encryption) and mac_key (authentication).
Phase 2

Request Encryption

Every API call from the frontend is wrapped in an APEX envelope.

{
  "iv": "base64-12-byte-initialization-vector",
  "ciphertext": "base64-aes-256-gcm-encrypted-payload",
  "seq": 42
}
Phase 3

Server Verification

The ApexFilter intercepts incoming requests and performs four checks before passing data to the controller.

  • Session validity check
  • Authentication tag validation (AES-GCM built-in)
  • Sequence number verification (prevents replay)
  • Payload decryption and forwarding

Security properties

Confidentiality

AES-256-GCM encryption ensures nobody can read request or response content.

Integrity

GCM authentication tags detect any modification down to a single bit.

Authentication

HMAC-SHA256 signing ensures requests only come from valid sessions.

Replay Protection

Strict sequence numbering means captured packets cannot be re-sent.

Forward Secrecy

Ephemeral ECDH keys are discarded, protecting past traffic even if a future breach occurs.