This article follows your data from the pattern that you draw to the encrypted blocks on your device. It is for people who want to know exactly what DotSafe does. You do not need to know this to use the app.
Summary. DotSafe calculates a key from your pattern and does not store the pattern. Each item has its own random key. DotSafe divides each item into blocks of the same size and encrypts each block with AES-256-GCM. The blocks have random names, and cover files hide which blocks are real.
1. From the pattern to a key
The grid has 25 points, in 5 rows of 5. A pattern connects at least 4 points. Each point must be next to the previous point: across, down or diagonal. You cannot use a point two times.
When you lift your finger, DotSafe does these steps:
- It writes the pattern as the ordered list of the points that you touched.
- It calculates the pattern key with PBKDF2-HMAC-SHA256. The inputs are the pattern, a random 32-byte salt and 600,000 rounds. The result is a 256-bit key.
- It derives two keys from the pattern key with HKDF-SHA256. The locator finds the index of the vault. The index key decrypts that index.
- It erases the pattern and the pattern key from memory.
The 600,000 rounds take a short time on your device, which is why DotSafe shows "Opening…". For an attacker who tries many patterns, each guess takes the same time. This makes a search through many patterns slow and expensive.
The salt is a random value. It makes sure that the same pattern gives a different key for a different person. Thus an attacker cannot calculate keys for common patterns one time and use them on every device. DotSafe keeps the salt in iCloud Keychain, so your other devices calculate the same key from the same pattern. The salt alone gives no access to a vault.
How strong is a pattern?
A pattern has less entropy than a long random password. A short pattern is easier to guess. DotSafe shows a hint if your pattern has fewer than 6 points. Use a long pattern that does not start in a corner and does not make a simple shape. The slow key calculation helps, but it cannot make a very short pattern safe.
2. From the key to a vault
Each vault has one index. The index holds the list of items, their names, their folders and tags, and a random 256-bit vault key. The index key from your pattern decrypts the index. The vault key then gives the keys for the content.
Because the vault key is random and separate from the pattern, DotSafe can share a vault or sync it without a change to all of the content. It only needs to encrypt the vault key again.
If no index opens with your key, DotSafe opens a new empty vault. It does not show an error, and it does not count attempts. This is why there is no "wrong pattern" in DotSafe. Plausible deniability, explained says why this matters.
3. From a vault to encrypted blocks
When you add a photo, a video, a file or a record, DotSafe does these steps:
- It makes a random key for the item.
- It divides the item into chunks of 256 KiB. It fills the last chunk to the full size with random bytes. A small item, for example a record or a thumbnail, goes into a shared pack of the same size.
- It encrypts each chunk with AES-256-GCM and a random 96-bit nonce. The chunk header records the real length of the data, inside the encryption.
- It binds each chunk to its item and its position. If someone moves, swaps or reorders a block, decryption fails.
- It writes each block with a random name and no file extension, in one folder with all other blocks.
AES-GCM also checks that the data did not change. If one bit of a block changes, DotSafe cannot decrypt it and does not show it.
The padding is random and not zeros. Zeros compress well, and a compressed size would show the real size of the item.
4. Why all blocks have the same size
If each file kept its own size, a person who copies your storage could compare the sizes with known files. All blocks in DotSafe are exactly the same size. All index files are the same size too. The total number of blocks moves in steps of 16, so a small change does not show.
5. Cover files
When DotSafe first sets up its storage, it makes between 64 and 127 cover index files of random data. The number is random. Each new vault adds its own index and 2 to 6 more cover files. Cover files look the same as real index files. No key opens them.
When DotSafe saves a vault, it also writes new random data into the cover files that belong to that vault. Thus the change times of the files do not show which files are real.
The result: a copy of your storage shows a folder of same-size random blocks. It does not show how many vaults exist, which blocks belong to which vault, or how many items you have.
6. Nothing readable on disk
DotSafe decrypts into memory only. It does not write decrypted files, previews or caches to disk.
- Thumbnails are encrypted with the rest of the vault. The grid decrypts only the thumbnails for the rows that you can see.
- Videos play from memory. DotSafe decrypts the part of the video that the player asks for, one chunk at a time.
- The camera in DotSafe gives photos and videos to the app in memory. Nothing goes to Photos.
- Office documents are the one exception. iOS can show them only from a file. DotSafe asks you first each time. Then it writes one temporary copy with iOS Data Protection, and deletes it when you close it, when you leave the app, and at the next launch.
When the vault locks, DotSafe erases the keys from memory and clears its caches.
7. iCloud sync and sharing
With Pro, sync sends the same encrypted blocks to the private iCloud database of your Apple Account. Each index goes up with a different name from the one on your device, so a copy of your device and a copy of your iCloud cannot be matched by name. Cover records go up too. Apple stores the data and cannot read it. We do not receive it.
When you share a vault, the vault key goes only to the people whose contact code you entered. It is encrypted to their public key with X25519. The link that you send gives access to iCloud only, not to the key. Sharing a vault safely has the details.
8. Deleting data
On flash storage, an app cannot be sure that it overwrites the old bytes of a file. DotSafe does not depend on that. When you delete an item, DotSafe deletes its key from the index. Without the key, the encrypted blocks cannot be read, even if a copy of them stays in the storage for some time.
The tools
DotSafe uses Apple's CryptoKit for AES-GCM, HKDF and Curve25519, and Apple's CommonCrypto for PBKDF2. It uses no third-party cryptography. iOS Data Protection at the Complete level encrypts all app files again while your device is locked.
