How Sealed’s encryption works, in writing, with test vectors

What is written down

The specification describes, byte by byte, how Sealed 1.0.0 seals what you keep:

• the sealed value that holds a name, a note or a record field, using AES-GCM;
• the file format for photos, videos, documents and thumbnails, in chunks that a reader checks one by one;
• the recovery key, written in the Crockford base 32 alphabet;
• the file you can send to another Sealed user, locked with a key made from a passphrase by PBKDF2;
• the records the backup holds, and what the storage service can see of them.

It also lists what Sealed does not encrypt, such as the dates and sizes in the app’s local database, and the limits its makers know about. Names, notes and the fields of a record are sealed with your vault key too, not just the photos. Large files are encrypted in chunks, and Sealed refuses a file that has been changed, reordered or cut short.

Which version it covers

This edition is for the formats of Sealed 1.0.0, which later versions still read. Features added since then, such as a replaceable recovery key, the vault passphrase and the open copy of the vault, are not in this edition. You can make a new recovery key in Settings; the current one keeps working until the new one is saved and your next backup finishes, and anyone with the old key and an old copy of your backup could still open that copy. With a vault passphrase, your vault key is sealed under a passphrase you type every time the vault unlocks, and if you lose it only your recovery key opens the vault.

The three files

• The specification. A plain text file in Markdown. Every format has a section, and each section says what a reader must refuse.
• The test vectors. Inputs and outputs made by the app’s own code: a sealed value, files of several sizes, a recovery key in the spellings people type, a file locked with a passphrase, and a set of damaged inputs that a reader must refuse.
• The checking program. A Python script that decrypts every vector using only what the specification says, and reports the first thing that does not match.

Check it yourself

You need Python and its cryptography package. Put the three files in one folder and run:

python3 -m venv venv
venv/bin/pip install cryptography
venv/bin/python3 -I verify_vectors.py vectors.json

The program prints one line per group of vectors, PASS or FAIL, and ends with a RESULT line. It was written without access to the app’s source, from the specification and the vectors alone. Where that first attempt could not follow the text, the text was corrected, and the program was run again.

What a pass means

A pass means the formats in the specification are the formats in the vectors, and that a second program, written separately, reads them. So anyone with the key can read a Sealed file with their own code.

It does not mean the app does only what the document says. The app’s source is not published. Sealed has not had an independent security audit.

Where Sealed helps, and where it doesn’t

It helps a reviewer, a researcher or another developer read Sealed’s formats, run the vectors and see how a file is sealed, instead of taking a sentence on a store page on trust. Sealed encrypts every file with AES-256-GCM before it is saved.

It doesn’t prove behavior. The document describes formats: it can’t show that the app never writes a file in the clear, or that nothing else in it gives data away. Those claims need the source or an audit, and neither is public yet. Sealed has not had an independent security audit.

If you find a mistake in it, or a way to read what the specification says is sealed, report it.