SyFly encryption

The idea

• Your device does all the cryptography. Passwords, notes and files are encrypted before they leave it and decrypted only on it.
• The server holds locked values only. It stores encrypted data and encrypted keys, and moves them between your devices and the people you share with. It never receives your master password or an unlocked key.
• One master password, many keys. Every container, repository, group and item has its own random key. They are all locked, directly or indirectly, under one account key that only your master password, your recovery key or your Face Key can open.
• Each locked key works in one place only. A key is sealed to its owner and to what it protects, so it can't be reused for anything else or by another user.

The keys

• Master password: What it is: Typed by you, never sent anywhere; What it locks: Turned into a key-wrapping key (PBKDF2, 1,000,000 rounds, a salt of your own), which locks the account key
• Account key: What it is: A random 256-bit key, created on your device; What it locks: Your private key and your own copy of every container, repository, group and item key
• Key pair: What it is: RSA-4096: the public key is stored in clear, the private key locked under the account key; What it locks: Keys other people share with you
• Container key: What it is: Random 256-bit, one per container; What it locks: The passwords and notebooks inside the container
• Repository key: What it is: Random 256-bit, one per repository; What it locks: The repository's entries
• Group key: What it is: Random 256-bit, one per group; What it locks: Every item or repository shared with the group
• Item key: What it is: Random 256-bit, for a password or notebook outside a container; What it locks: That item's content
• Recovery key: What it is: 32 random bytes you save (52 characters); What it locks: A second copy of the account key, for when the master password is forgotten
• Face Key: What it is: Recovered from your face, plus a server part released after the email code and your PIN; What it locks: A copy of the account key on that device

Encrypting

Creating a container, repository, group or item

• Your device generates a new random 256-bit key for it.
• It seals the key under your account key, bound to you and to what it protects, checks it opens back, and only then sends it.

Saving a password or a note

Anything still in the older format is converted to this one by your device: accounts and keys the next time you type your master password, the content of your items after you unlock, and the items of a passphrase or security-key container when you open it. Each item is rewritten only if nobody changed it meanwhile. If you unlock with Face Key or on a new device while older copies remain, SyFly asks for your master password once to convert them.

Every rewrite of a key copy names the copy it replaces (by its hash). If another device changed that copy in the meantime, the server refuses the write and your device starts again from the current copy, so a newer key is never overwritten with an older one.

• Your device opens the key of the container (or item) it goes into. An item inside a container that is shared on its own has a key of its own, sealed under the container key.
• It encrypts the content with AES-256-GCM under a key derived from that key, and sends only the encrypted result.

Decrypting

Unlocking your vault

Changing the master password, or resetting it with the recovery key, is a single transaction. Your device first converts any copies still in the older format, then re-locks the account key, the recovery copy and every copy still tied to the master password, and sends them together. The server applies all of it or none of it, and refuses if the list doesn't match the copies it holds.

• Master password: What happens on your device: Derives the key-wrapping key, opens the account key, then the private key
• Face Key: What happens on your device: Your face, the email code and your PIN open the copy of the account key kept for Face Key, then the private key
• Recovery key: What happens on your device: Opens its copy of the account key; you then choose a new master password, which re-locks the same account key
• Open session: What happens on your device: Reuses the account key kept for the session until it expires or you log out

Opening an item

• Your device opens the container, repository, group or item key with your account key (or, for something shared with you, with your private key or the group key).
• It decrypts the content with that key. A key or content that doesn't open is an error: it's never guessed.

Sharing

A container locked with your master password

• When you share it, your device locks the container key with each recipient's public key straight away (RSA-OAEP, 4096-bit, SHA-256).
• Someone without keys yet gets an invitation with no key. Your device locks their copy the next time you unlock or open that container after they have created their keys.
• Recipients can leave a shared container; that deletes their copy.
• The first time they open it, their device opens that copy with their private key and re-locks it under their own account key (AES-256-GCM, bound to them and to that container).

A container locked with a passphrase or security key

• Recipients can't use your secret, so you choose theirs: a passphrase you tell them, a security key you give them, or the answer to a question. Their copy is locked with that secret (see Passphrase and security-key containers).
• Each recipient with a SyFly account gets a copy of their own, sealed with PBKDF2 (a salt of its own) and AES-256-GCM and bound to them: no one else can open it, even with the same secret. Someone invited before they have an account gets a copy in the older format, which their device replaces with this one the first time they open it.
• Question and answer: only the answer locks the copy. The question you pick is stored encrypted to each recipient's public key (RSA-OAEP), so only their device can read it and show it to them. The answer is trimmed and lower-cased before use, and has no length limit (up to 32 characters for someone without an account yet).
• Security key you hand over: you touch it while sharing. Its registration is added to the recipient's account, and their copy is sealed with that key's FIDO2 secret and bound to them, so they open it with one tap. If you skip the touch, their copy is locked with the key's typed code instead.
• With a security key, a recipient can add a copy that opens with their own registered key.

Passwords, notes and repositories

• The item's key is locked with the recipient's public key (RSA-OAEP), and their device re-locks it under their account key.
• An item inside a container gets a random 256-bit key of its own the first time it's shared on its own. That key is sealed under the container key, and only the item key is handed over: the person never receives the container key.
• If a container's key was ever handed over with a single item, your device gives the container a new key: right after you type your master password, or for a passphrase or YubiKey container when you open it with its passphrase or YubiKey code. It re-locks every copy, and each such item gets its own key. When the container's backup person or recipients open it with a secret you chose for them, your device asks you to enter those secrets again; each one is checked against that person's current copy before anything changes, and none is stored. A copy that only someone's own security key can open can't be re-made this way, so that container keeps its key.

Groups

• A group has its own random 256-bit key, locked for each member with their public key.
• Items shared with the group are locked once, with the group key, for all members. A new member reads everything already shared with the group.

Backup person

• Their copy of the container key is locked with a passphrase or security key you choose (not with their public key), and the server releases it only once the backup is triggered: your inactivity period ends, or you approve their request.
• Your message to them is encrypted with a random key per message (AES-256-GCM). That key is locked with RSA-OAEP twice: once for you, once for them.

New key pairs and removing access

• New key pair. When someone you share with gets a new key pair, the next time you unlock your device locks fresh copies for their new public key, including your backup messages to them. When you get a new key pair, your copies of your backup messages are re-locked with it in the same step.
• A copy that no longer opens. If your device can't open your copy of a shared container (for example it was locked under a master password you no longer use), it asks the owner for a new one, and the owner's device locks a fresh copy for your public key the next time they unlock.
• Removing someone deletes their copy of the key.

Passphrase and security-key containers

A container can be locked with a secret other than the master password. Its key is then sealed under that secret instead of the account key:

Every copy is sealed this way from the moment it's made, and bound to whoever holds it: the owner, the backup person, or each recipient. SyFly never receives any of these secrets.

• Passphrase or security answer: How the container key is locked: PBKDF2 with a salt of its own, then AES-256-GCM
• Security key (YubiKey): How the container key is locked: A secret only the physical key can produce (FIDO2), then AES-256-GCM; one copy per registered key

On your device

• While unlocked, the account key and private key are kept for the session, encrypted with a session key (web) or in the system keychain (desktop, mobile). Logging out or the session timing out removes them.
• Opened container and item keys are cached the same way, so items open without asking again.
• Auto-lock: the web app forgets these keys after 15 minutes without activity, the browser extension after 30 minutes or when the screen locks. On the web, a copied password or recovery key is cleared from the clipboard after 45 seconds.
• Files you attach are read and encrypted on your device; the server only ever receives the encrypted file.
• AutoFill (iOS, Android, macOS) uses a sealed local copy of your private key and of the item keys you've opened, protected by the system keychain.

Algorithms

• Master password → key: Algorithm: PBKDF2-SHA256, 1,000,000 iterations for new accounts (the apps refuse fewer than 600,000), 16-byte salt per account
• Keys derived from a key: Algorithm: HKDF-SHA256, a separate key for each purpose
• Locking keys: Algorithm: AES-256-GCM, random 96-bit IV each time, bound to the user and to what the key protects
• Item content: Algorithm: AES-256-GCM under a key derived from the item's or container's key, random 96-bit IV each time
• Sharing: Algorithm: RSA-OAEP 4096 with SHA-256
• Face Key: Algorithm: On-device face model and a fuzzy extractor
• Security keys: Algorithm: FIDO2 / WebAuthn PRF