Plausible Deniability, Decoy Vault & Instant Locks

A standard vault fails when someone demands that you unlock the app in front of them. Vaultron separates everyday privacy, non-destructive plausible deniability, and emergency local destruction into independent cryptographic key slots inside its 4,096-byte binary header.

Key Slot 7: Non-Destructive Decoy Vault

Entering your Decoy passcode unwraps an isolated secondary Master Key and opens a separate vault populated with harmless cover photos or receipts. On disk, Slot 7 masks its status bits to zero so it remains byte-for-byte indistinguishable from unallocated header slots.

Key Slot 6: Optional Duress Wipe

Designed for high-risk travel and coercion scenarios. Entering your optional Duress passcode zeroes your local Primary Vault partition, disables CloudKit sync before remote records can be touched, and promotes your Decoy Vault to Slot 0 with no warning banners.

Face-Down & Proximity Instant Lock

While unlocked, CoreMotion gravity monitoring (g_z > 0.82) and the iPhone proximity sensor watch for sudden movement. Flipping your phone face-down on a table zeroizes the active Master Key in mlock-pinned RAM within 100ms.

Safe Hand-Off Presentation Lock

Need to hand your unlocked phone to someone to inspect a single ID scan, receipt, or photo? Enable Hand-Off Lock in the item viewer to block horizontal swiping, sheet dismissal, and toolbar actions until you authenticate with Face ID or your device passcode.

Implementation Details

Binary Header Layout 4,096 bytes (APFS page-aligned) with HMAC-SHA256 integrity tag

Primary Vault Slots Slot 0 (Passcode / Pattern), Slot 1 (12-Word BIP-39), Slot 2 (Secure Enclave P-256), Slot 3 (Secondary)

Decoy Vault Slot Slot 7 (Pro) with masked 0x00000000 on-disk status for anti-forensic indistinguishability

Duress Wipe & Strict Mode B Slot 6 local Primary wipe (Pro) + optional Mode B synthetic empty vault on mistyped passcodes

RAM Key Zeroization Page-aligned posix_memalign + mlock + memset_s on lock or background transition

Capture & Switcher Protection Hardware secure-layer container blocks screenshots, screen recording, and App Switcher snapshots

Questions & Answers

Can someone tell that a second vault exists by inspecting the app interface?

No. When unlocked with your Slot 7 Decoy credential, Vaultron renders the exact same library layout, folder bar, and settings interface without displaying slot numbers or hidden-vault indicators.

Does Duress Wipe (Slot 6) delete my encrypted iCloud sync data?

No. Triggering Slot 6 halts CKSyncEngine locally before wiping Primary keys and ciphertext files on the device, so you can restore your vault later on a safe device using your Primary Passcode or 12-word Recovery Key.