Security — HushKeep

This page is a public summary of HushKeep’s security design. It names what the app protects against, what it does not, and which primitives it uses. The goal is to let you judge the design yourself — not to market it.

The design in one paragraph

Every vault has its own keys. Files are encrypted on your device with AES-256 before they’re saved or backed up. The keys are derived from your pattern (or your 9-word recovery phrase) combined with a random device secret that lives only on that device, and — where the device has a Secure Enclave — bound to it so the derived keys cannot be computed on any other hardware. Backups are encrypted before they reach iCloud, so Apple stores data it can’t read. We run no server that receives your files or keys. No account needed. We collect no analytics and no personal data.

Who we are trying to protect against

Threat	What each attacker gets
Someone holding your phone and forcing you to unlock it	Only the vault you open is revealed. The UI shows no list of vaults, and the emergency (duress) unlock looks the same on screen as a normal one.
A thief or snoop without your pattern	No file contents. Pattern guessing is possible only through the app’s own UI, and it is throttled: 5 free attempts, then waits of 30 s, 1 min, 5 min, 15 min and 1 hour.
An offline copy of the app’s files without the device keychain	No file contents, and no number of vaults: the keyslot table is fixed-size and random-looking, the objects are uniform, and the occupancy data lives in the device keychain. Offline pattern guessing is not possible, because the device secret and hardware binding are missing.
A copy of the app’s files including the device keychain	No file contents. The number of vaults leaks only as a range (the keyslot table mixes real slots with chaff slots, 6 to 14 of them), and pattern guessing still requires the live Secure Enclave — on the seized device itself, at about one Argon2id evaluation per guess.
An iCloud operator, or a breach of your iCloud	No file contents. What leaks is a range of vault counts, plus a documented count of frequently modified records (planned to be mitigated in a future version). Cloud pattern slots cannot be guessed offline because the cloud secret sits in iCloud Keychain; recovery slots face Argon2id at its strongest setting against a 68-bit phrase, which is infeasible for generated phrases.
A network attacker	All traffic is inside standard TLS (your app to App Store, your device to iCloud); there is no HushKeep server to attack.

What we do not claim

We state our limits publicly, because a security product that hides its limits deserves no trust:

A compromised operating system, a jailbreak with live memory access, or malware running while a vault is unlocked can read what is on screen. We do not protect against these.
Comparing two copies of the device (or two points in time of your iCloud) can show which data changed. We do not protect against that.
Someone watching you draw your pattern will see it. The optional “hide pattern trail” reduces but does not eliminate that.
Side channels (power, electromagnetic, fine timing) are out of scope.
Physical coercion beyond what the emergency pattern covers is out of scope.
Apple shipping malicious iOS or iCloud Keychain code is out of scope.

The primitives

Purpose	Primitive
Authenticated encryption	AES-256-GCM (96-bit nonce, 128-bit tag)
Key derivation from your pattern	Argon2id, 64 MiB memory, 3 iterations
Key derivation from your recovery phrase, and cloud pattern slots	Argon2id, 128 MiB memory, 4 iterations
Key separation between derivations	HKDF-SHA256
Binding to the device	ECDH P-256 with a Secure Enclave private key (on devices that have one)
Randomness	The system CSPRNG

The two Argon2id parameter sets are fixed constants of the storage format: they cannot be changed after release without a new format version and a migration. The encryption formats are covered by known-answer test vectors (an independent reference implementation and the app’s implementation must produce byte-identical output).

Your keys, your only keys

Pattern: at least 6 dots; intermediate points are part of the encoding, so two patterns that look alike on screen are not alike to the app.
Recovery phrase: 9 words, 68 bits of entropy for generated phrases; written down, it is the only way to open the vault from any future device.
Device secret: random, created when the vault store is first created, lives only on the device (and in iCloud Keychain for the cloud part).
Chaff slots: 6 to 14 dummy slots that make the keyslot table look the same whatever the real vault count is.

Your vaults can only be decrypted with your pattern or recovery phrase. We hold neither.

Privacy of the running app

Auto-lock closes open vaults when the app goes to the background (default: immediately; options: 30 s, 1 min, 5 min).
Privacy cover hides vault content while the app is inactive, and while a screen capture is in progress, so screen recordings and the app switcher show no photos.
Clipboard hygiene: exported text (for example a copied recovery phrase) expires from the clipboard after 60 seconds.
No telemetry: the app sends no analytics, no crash reports of its own, and no usage data.

Privacy policy — what we store and what we never see.
Features — the emergency pattern in detail.
What to do if someone forces you to unlock your phone — the duress scenario, step by step.