A decoy workspace for a device that travels MIRAGE

Why there is no flag saying which one is the decoy

Both vaults are AES-256-GCM ciphertexts of the same shape, sitting in the same blob in random order, with the label that says what each one is stored inside the ciphertext rather than beside it. Each has its own random sixteen-byte salt, its own random twelve-byte initialisation vector, and a key stretched from its own PIN with PBKDF2-SHA256 over 310,000 iterations. Unlocking tries each vault in turn and returns whichever one authenticates.

The consequence is the point: somebody holding the blob cannot tell which PIN opens which, because there is nothing in the file that says. GCM's authentication tag means a wrong PIN fails rather than producing plausible-looking rubbish, so there is no way to grind through and recognise the real one by eye either.

What the blob does not hide is that there are two. The array has a length and the ciphertexts have sizes, both readable, and nothing here pads or disguises them. That is stated rather than glossed over, because a tool that implied otherwise would be inviting somebody to rely on a property it does not have.

A four-digit PIN is ten thousand guesses

PBKDF2 at 310,000 iterations makes each of those guesses cost real work, enough that trying all ten thousand takes meaningful time on ordinary hardware. It does not make ten thousand a large number. An attacker who has the blob has it offline, with as much time and as many machines as they care to spend, and there is no lockout to stop them.

Longer PINs are supported and the difference is not marginal: six digits is a hundred times harder, and a short passphrase of unrelated words is not in the same universe as either. Use one if the device might genuinely be taken. The four-digit option exists because a PIN you have to look up is a PIN you will not use, and an unused vault protects nothing. SHADOWKEY will tell you what any given choice is actually worth.

Deniability is about your situation, not about a file format

This is the part that matters more than the cryptography, and it is the part people get wrong. A decoy vault works only if the story around it holds up.

Somebody who knows this tool exists knows a second vault may exist. A decoy that is obviously empty, or obviously assembled in five minutes, is worse than no decoy at all, because it demonstrates that you were expecting the question. A decoy that has not been opened in eight months, on a device you use daily, says the same thing. If you are going to keep one, keep it as though it were the real one: put genuine but unimportant material in it, and open it from time to time.

And there is a limit that no amount of care gets you past. In some jurisdictions, failing to disclose what a device holds when you are lawfully required to is itself an offence, carrying its own penalty regardless of what is in the vault. This tool is not for that situation and says so on the page above; see acceptable use. It is for a lost laptop, a stolen phone, a shared machine, a border where a casual look is what you expect: the cases where the person holding the device is not entitled to compel you.

For the rest of the work: DEADBOLT clears what this site has stored in a browser, KEYS and JOURNAL keep their own contents encrypted at rest, and CAPSULE makes a single encrypted file anyone can open in a browser with the passphrase and nobody can open without it.