How Silock protects you

What happens when you add a photo

1. You add a photo from Photos, Files or Silock’s own camera.
2. It encrypts it in pieces of 256 KB, each with its own fresh random number, using AES-256-GCM. GCM also detects any change to the encrypted data, so a damaged or tampered file is refused rather than shown.
3. Only the encrypted result is written to your iPhone’s storage, under a random file name that says nothing about which silo it belongs to.

Silock keeps no unencrypted temporary files or caches of its own. The two exceptions are ones you choose: saving a video back to Photos, and saving a copy to Files. Each needs a normal file, so Silock makes one, protected by iOS, and removes it as soon as Photos or Files has taken it.

Where the keys come from

Your files are encrypted with a random 256-bit key. That key is stored only in a locked form, and two things can unlock it:

• Your unlock. Your PIN, password or pattern is combined with a random value kept in this iPhone’s Keychain and run through PBKDF2-SHA512 600,000 times. That takes about half a second on purpose: it makes guessing slow.
• Your recovery phrase. The 12 words are run through PBKDF2-SHA512 800,000 times to make a separate recovery key.

From the main key, Silock derives separate keys for each job (file contents, thumbnails, names and dates, the index) with HKDF-SHA256, and a separate key for every single file. Changing your unlock re-locks the main key only, so it’s instant and your files are never re-encrypted.

Silos

• The list of silos is encrypted, so their names, colors and number stay hidden until Silock is unlocked. The unlock screen shows nothing about them.
• A password-free silo’s key is locked with a key derived from Silock’s own, so unlocking Silock opens it.
• A silo with its own password has its own key and its own recovery phrase. Silock’s unlock, Face ID and the app’s recovery phrase can’t open it.

Wrong guesses

After 5, 10 and 15 wrong unlocks in a row, Silock makes you wait 30 seconds, 5 minutes and then an hour. The count survives closing and reopening the app, and changing the clock doesn’t skip the wait. If you turn it on, Silock erases every silo after 20 wrong unlocks in a row.

When Silock locks

Silock locks when you leave it, when your iPhone locks, and when you shake your iPhone or turn it face down. On locking, the keys in memory are overwritten and every decrypted thumbnail and preview is dropped. In the app switcher, Silock shows a cover instead of your screen.

Face ID

Face ID is off unless you turn it on. iOS checks your face and Silock never receives face data. Face ID opens Silock and its password-free silos, never a silo with its own password.

iCloud backup

The backup uploads Silock’s files as they already are: encrypted. Each file is padded to a fixed size bucket so the backup doesn’t reveal exact sizes, and the list of what’s in the backup is encrypted too. It’s stored in your own private iCloud database. Apple holds encrypted data it can’t read, and we hold nothing.

Files on your iPhone

Every file Silock writes also gets iOS Data Protection, so closed files can’t be read while your iPhone is locked. Files are written in full before they replace the old version, so a crash never leaves a half-written file.

No account, no servers, no tracking

There’s nothing to sign up for and nothing of yours on any server of ours, because we don’t run any. Silock contains no analytics or advertising code. Purchases go through Apple, and Apple never tells us who you are.

The honest limits

No app can protect against everything. These are Silock’s limits, stated plainly:

1. If your iPhone is unlocked and Silock is open, anyone holding it can see what’s on screen.
2. A jailbroken or otherwise compromised iPhone weakens all of these protections.
3. Someone with forensic access to Silock’s storage could estimate how many silos exist, but can’t read them, their names, or your unlock.
4. Face ID can be forced. A silo that needs protecting under pressure should have its own password.
5. If you lose both your unlock and your recovery phrase, your files are gone. No one can recover them, including us.
6. A short PIN or a simple pattern can be guessed by someone with your iPhone’s storage and enough computing time. Longer PINs and passwords, and the waits between wrong guesses, make that much harder.
7. Deleting a file overwrites it, but on flash storage that can’t be guaranteed to reach every physical copy. The real guarantee is that without the key, the data is unreadable.

Silock uses only standard, published methods, through Apple’s CryptoKit and CommonCrypto. Nothing is home-made.

Sources

• NIST SP 800-38D: Galois/Counter Mode (GCM)
• NIST SP 800-132: Password-Based Key Derivation
• RFC 5869: HMAC-based Key Derivation Function (HKDF)
• Apple Platform Security guide