Skip to content

Your pattern is not the whole key.

A copy of a Sigil vault cannot be guessed open on someone else's computer. The key needs your pattern and a secret that lives inside this iPhone's Secure Enclave and cannot be exported. This page says how, and where it stops working.

Last reviewed

How your pattern becomes a key

Read the chain top to bottom. Each box feeds the next, and the vault key only exists when the pattern key and the device secret are both present.

  1. Pattern

    The shape you draw on the 5 by 5 grid, encoded as a length byte plus the dot positions. It never leaves the phone.

  2. Argon2id

    A memory-hard hash that runs on the phone with 64 MiB of memory and 3 passes. Its output is the pattern key.

  3. Secure Enclave secret

    A device secret made from a Secure Enclave P-256 key that cannot be exported. Only this iPhone can produce it.

  4. Vault key

    HKDF-SHA256 combines the pattern key with the device secret. Without both inputs the result is wrong.

  5. Master key

    32 random bytes per vault, unwrapped by the vault key. Changing your pattern only re-wraps it, so no file is re-encrypted.

  6. Files

    Each file gets its own key derived from the master key and is stored as 1 MiB chunks, each sealed with AES-256-GCM.

A separate path exists for a new phone: the 12-word recovery phrase derives a recovery key (HKDF over its entropy) that unwraps the master key without the Secure Enclave.

What a copy of your vault gives an attacker

Vault files are stored with complete file protection on the phone. If someone copies them off, they get ciphertext. Files are padded before encryption, so sizes leak at most about 12% of their bits, and every file has a random name in one shared pool, so nobody can tell which vault owns which file.

Trying pattern guesses needs the Argon2id output and the device secret together. The device secret never leaves the Secure Enclave, so the guessing cannot be moved to a rented cluster. It has to happen on your phone, where each guess costs 64 MiB of memory and, after 5 failed attempts, waits grow to 30 seconds, then 1 minute, 5 minutes and 15 minutes. The failure counter lives in the Keychain, so deleting and reinstalling the app does not reset it.

Hidden vault count

Sigil creates 32 fixed-size slot files at install and fills all of them with random bytes. Making a vault overwrites one of the decoys. Deleting a vault writes a fresh decoy. A forensic copy always shows 32 slots that look the same, whether you have one vault or ten.

A pattern that opens nothing gets the same shake as a wrong guess, so trying a pattern never confirms whether a vault exists. One honest leak remains: the free-tier vault limit needs a counter, and it is kept as a single integer in the Keychain.

What Apple sees

Planned

Encrypted iCloud backup is planned for a later version and is not part of the first release. Nothing here describes shipped behavior. The network stays off until you turn it on.

The design: only ciphertext goes to your own iCloud. Apple would see record counts, padded sizes, timestamps and your iCloud account. It would never see the pattern, the recovery phrase or any key.

The backup is keyed to the 12-word recovery phrase, which has 128 bits of entropy, and never to the pattern. If a copy held by Apple leaked, an attacker would face a 128-bit key and not a 5 by 5 pattern.

What Sigil cannot protect against

  • A jailbroken phone. If the operating system is compromised, the guarantees above no longer hold.
  • A phone that is already unlocked. While a vault is open its contents are on screen and its keys are in memory. Sigil blurs the app switcher, hides the vault during screen recording or mirroring, and locks by default when you leave, but it cannot help if someone is holding the open phone.
  • Someone watching you draw. The pattern trace is hidden after setup, but a person who sees your finger can copy the shape.
  • Losing both the pattern and the recovery phrase. Nobody can recover those files, including Sigil.
  • Memory handling limits. Apple's SymmetricKey type cannot be zeroed, so Sigil keeps those keys alive for as short a time as it can.
Planned

Sharing is planned for a later version. Its expiry and open limits would be enforced by the app, so a modified app could ignore them. An external review of the cryptography is also planned before backup ships, with the design document published here.

Why a recovery phrase and not an email reset

An email reset needs a server that can undo your encryption, and an account to attach it to. Sigil has neither. At setup you get a 12-word recovery phrase. It is the only way to open a vault away from this phone, which matters because Secure Enclave keys do not move to a new iPhone. After a phone migration or restore, you open each vault once with its phrase.

The price is plain: keep the phrase somewhere safe. If the pattern and the phrase are both gone, so are the files.

Keep reading

More explanations, written for people who are not cryptographers, are on the blog.

Keep it yours.