Cryptile security architecture, layer by layer
Cryptile encrypts every file, thumbnail and index with AES-256-GCM, using keys made on your phone from the pattern you draw. There is no account and no server, and the developer never holds keys.
Try Cryptile free: join the beta on TestFlight
The plain summary is on the security page.
What do I need to know?
- Your pattern is the source of every key. Nothing readable is stored without it.
- Sizes and vault counts are blurred. Files are padded and decoy slots hide how many vaults exist.
- You can check it. The encryption core is published for audit (source-available) with a threat model and test vectors: github.com/jasonbrelsford/cryptile-core.
How does a pattern become a key?
- The pattern is written as the grid size followed by the cells you touched, in order.
- It is mixed with a 32-byte device secret kept in the iPhone Keychain for this device only.
- PBKDF2-HMAC-SHA512 runs 600,000 times over it. Each guess costs that much work.
- HKDF-SHA256 splits the result into a lookup key and a wrap key.
- The lookup key names the vault's index file. The wrap key opens it.
Inside the index sits the vault's random 256-bit master key. HKDF derives separate subkeys from it for files, thumbnails and the index. No key is used for two purposes.
How are files encrypted?
Small items, like thumbnails and the index, are sealed in one piece with AES-256-GCM and a random nonce.
Large files use a STREAM layout in 1 MB chunks. Each chunk has its own nonce and records its position and whether it is the last. Cutting, reordering or swapping chunks makes decryption fail.
GCM also authenticates every header, so a changed file is rejected rather than shown.
How are sizes and vault counts hidden?
Every small blob and every final file chunk is padded to a multiple of 64 KiB. A copier sees rough sizes, not exact ones.
There is no vault list. The app keeps at least 8 index-shaped slots, real and decoy, and re-rolls the decoys on every write. A pattern that names no slot opens an empty vault.
How does recovery work?
Each vault gets a 9-word recovery phrase, which is 96 bits of randomness. It opens a separate recovery copy of the vault, sealed under a key made from the phrase.
The iCloud backup mirrors the encrypted files as they are. The device secret is not in it by default, so a backup alone cannot be used to guess patterns.
What is encrypted, and what is not?
Encrypted: photos, videos, files, notes, thumbnails, names, folders, favourites, recognised text and photo locations. The small file that tracks decoys and free-plan counts is sealed with a device key.
Not encrypted by Cryptile:
- Settings. The auto-lock time, sort order and backup switch hold no secrets.
- Shared items waiting to be added. They sit under iOS file protection until you open a vault.
- The container's total size and write times. A 10 GB vault does not look like 10 MB.
- Anything you export. A copy saved to Photos or Files is outside the vault.
What does this protect against?
- Someone copying the app's files without your Keychain. They get ciphertext and cannot try patterns.
- Apple, or a breach at Apple. iCloud holds ciphertext and no keys.
- Tampering. Changed or reordered data fails to decrypt.
- Us. We run no server and hold no keys, so we cannot reset access.
What does this not protect against?
- Short patterns. A pattern is weaker than a passphrase. With your files and your Keychain, a 6-cell pattern on a 4×4 grid falls in minutes on a GPU. Use 8 or more cells.
- Malware on an unlocked phone. Code that reads memory while a vault is open is beyond any app.
- Someone watching you draw. Draw where nobody can see your hand.
- Losing the phone and the phrase. The vault is gone. There is no reset.
The panic pattern in Plus destroys the device secret, so no vault on the phone opens until restored.