Military-Grade Security

Zero-Knowledge Architecture

Veilith employs cutting-edge cryptographic protocols and innovative security mechanisms to ensure your data remains protected against even the most sophisticated adversaries.

Defense In Depth

Multiple layers of security ensure that even if one layer is compromised, your data remains protected by numerous additional safeguards.

Layer 1: Cryptographic Core

State-of-the-art encryption algorithms provide the foundation of our security model.

  • XChaCha20-Poly1305 IETF encryption
  • 256-bit encryption keys
  • Authenticated encryption with additional data

Layer 2: Deniable Encryption

Plausible deniability through sophisticated data hiding techniques.

  • Multiple password-protected entries
  • Cryptographically secure random padding
  • Indistinguishable encrypted blocks

Layer 3: Steganographic Concealment

Hide encrypted vaults within innocent-looking images.

  • LSB (Least Significant Bit) embedding
  • Zlib compression for efficiency
  • Multi-image distribution support

Cryptographic Implementation

Deep dive into the technical security measures that protect your data at every level.

Key Derivation & Management

Argon2ID Algorithm

Winner of the Password Hashing Competition, Argon2ID provides state-of-the-art protection against password cracking attempts.

Algorithm: Argon2ID v1.3
Memory: 64 MB (Interactive)
Iterations: 3
Parallelism: 4
Output: 256-bit keys

Device Integrity Keys

Each device generates a unique integrity key stored in the iOS Keychain, preventing cross-device access even if passwords are compromised.

  • 256-bit device-specific keys
  • HMAC-based integrity verification
  • Secure Enclave protection when available

Encryption & Authentication

XChaCha20-Poly1305 IETF

A modern AEAD cipher providing both confidentiality and authenticity with exceptional performance.

Cipher: XChaCha20 (256-bit key)
MAC: Poly1305 (128-bit tag)
Nonce: 192-bit (24 bytes)
Block Size: 8192 bytes
Mode: AEAD (Authenticated Encryption)

HMAC Integrity Protection

Every vault is protected with HMAC to detect tampering or corruption.

  • SHA-256 based HMAC
  • Device-bound integrity verification
  • Tamper-evident design

Deniable Encryption Architecture

Our unique implementation provides true plausible deniability through sophisticated data organization.

File Structure

1

Device HMAC (32 bytes)

Ensures file integrity and device binding

2

Salt Array (64 × 16 bytes)

Fixed-size array containing both real and fake salts

3

Data Blocks (64 × 8192 bytes)

Mix of encrypted data and random padding

Security Properties

Indistinguishability

Real encrypted blocks are cryptographically indistinguishable from random padding blocks.

Constant-Time Operations

All decryption attempts check every salt and block to prevent timing attacks.

Randomized Placement

Encrypted blocks are placed at cryptographically random positions within the file.

Steganographic Concealment

Advanced image steganography hides encrypted vaults in plain sight.

Data Compression

Vaults are compressed using zlib before embedding to maximize capacity.

Algorithm: DEFLATE (zlib)
Level: Default (6)
Ratio: ~40-60% typical

LSB Embedding

Data is hidden in the least significant bits of RGB channels.

Channels: RGB (skip alpha)
Bits/pixel: 3
Capacity: W×H×3 bits

Multi-Image Support

Large vaults can be distributed across multiple cover images.

Chunk size: 200KB
Auto-split: Yes
Reassembly: Automatic

Steganography Process Flow

Encrypted Vault

Compression

LSB Embedding

Additional Security Measures

Beyond encryption, Veilith implements numerous security best practices.

Secure Memory Management

Sensitive data is securely zeroed after use using memset_s to prevent memory analysis attacks.

Destruction Keys

Emergency passwords instantly overwrite vaults with cryptographically secure random data.

Cryptographic Randomness

All random values are generated using libsodium's cryptographically secure RNG.

Timing Attack Prevention

Constant-time operations ensure decryption attempts don't leak information through timing.

No Cloud Sync

Device-specific keys prevent synchronization, ensuring data never leaves your device unintentionally.

Secure Export/Import

Device integrity is recalculated during import, maintaining security across device transfers.

Audited & Verified

Our security implementation has been thoroughly reviewed and meets industry standards.

Security Standards

NIST Compliance

Algorithms meet NIST recommendations for post-quantum security

OWASP Guidelines

Follows OWASP mobile security best practices

iOS Security Model

Leverages iOS Keychain and Secure Enclave when available

Threat Model

Physical Device Access

Protected by device-specific keys and destruction capabilities

Coercion & Rubber-hose Attacks

Deniable encryption provides plausible deniability

Cloud Compromise

No cloud sync ensures data never leaves device

Experience True
Data Protection

Join security-conscious professionals who trust Veilith for their most sensitive information.