How Vaultron Encrypts Your Data
Every key derivation, chunk nonce, binary header slot, and memory buffer in Vaultron is structured so neither Treegarden Software Ltd, Apple, nor offline filesystem inspection can recover your plaintext without your credential.
1. Key Hierarchy & 4,096-Byte Binary Header
01 / SECRET
User Credential
6+ digit PIN, NFKD passphrase, 6+ node 5x5 pattern token, or 128-bit 12-word BIP-39 phrase.
02 / KDF
PBKDF2-HMAC-SHA512
600,000 iterations plus a unique 256-bit CSPRNG salt per slot derive a 256-bit Slot KEK.
03 / UNWRAP
256-Bit Master Key
Unwrapped via AES-256-GCM into page-aligned
mlock RAM. Credential changes re-wrap Slot 0 in O(1) time.04 / SUBKEYS
HKDF-SHA512 Isolation
Each item UUID derives an isolated 256-bit File Key (FEK), Envelope Key, and Thumbnail Key (TEK).
2. 8-Slot Header Allocation (4 KB)
Slot 0 · Primary CredentialPIN / Passphrase / Pattern
Slot 1 · Offline Disaster Recovery12-Word BIP-39 (128-bit)
Slot 2 · Biometric Hardware KeySecure Enclave P-256 ECIES
Slot 3 · Secondary CredentialOptional Passcode Slot
Slots 4 to 5 · UnallocatedCSPRNG Noise Filled
Slot 6 · Coercion EmergencyDuress Local Wipe (Pro)
Slot 7 · Plausible DeniabilityDecoy Vault MVK (Status 0)
3. Streaming 256 KB Chunks & Memory Hygiene
- 512-byte Sealed
VFILHeader: Encrypts item UUID, vault UUID, plaintext byte length, MIME type, chunk count, and SHA-256 digest under a dedicated HKDF envelope key. - 40-Byte Streaming AAD: Each 256 KB (262,144-byte) chunk binds
vaultUUID || fileUUID || chunkIndex || isFinalChunkinto AES-256-GCM AAD, preventing reordering, splicing, or trailing truncation. - Physical RAM Pinning: Key material resides in
SecureBytesallocated viaposix_memalign, pinned withmlock, and cleared viamemset_son lock. - Durable Commits: Writes flush via
fcntl(fd, F_FULLFSYNC)and pass tag verification before offering Camera Roll deletion.
4. Threat Model Matrix
| Scenario | Exposure in Default Tools | Vaultron Mitigation |
|---|---|---|
| Partner or thief knows iPhone passcode | Unlocks Apple Photos Hidden Album & Locked Notes | Independent vault credential; iOS passcode never unlocks Vaultron |
| Passing unlocked phone to show 1 photo | Recipient swipes left or right into adjacent items | Safe Hand-Off Lock freezes viewer onto 1 item until Face ID or passcode |
| Shoulder-surfing on transit or cameras | Captures typed PIN or visible drawn pattern | Hardware Secure Enclave Face ID unlocks with zero visible finger trail |
| Physical coercion or border inspection | Demands live unlock of visible vault app | 1-tap biometric disable + Slot 7 Decoy Vault + optional Slot 6 Duress Wipe |
| Cloud database breach or subpoena | Exposes server-side media or filename metadata | Zero Vaultron servers; optional iCloud stores only EncryptedVaultItem ciphertext |
| Broken iPhone or discontinued app in 2036 | Proprietary binary unavailable on future OS | Single-file emergency_decryptor.html unlocks .vaultbackup offline in any browser |