Sempere
Guide contents

How it works

Devices and keys

Every device has its own key that never leaves it, one home device approves the others, and the recovery kit can take over when home is lost.

Every device has its own key that never leaves it, the paper kit holds a separate recovery key, and one device, the home device, is in charge of the list of devices. This page explains the model; Managing devices and keys has the steps.

One key per device, one recovery key

  • Each device makes its own key when it creates or joins a vault. The key stays in that device’s Keychain (its signing keys in the Secure Enclave, where the device has one) and is never exported, copied or synced through iCloud Keychain.
  • Your recovery kit holds one more key, the recovery key. It exists only on paper (and, if you chose one, as a passphrase copy in the vault). No device stores it.
  • The vault has a vault key for each period between device changes (an epoch). Every file is encrypted to the vault key once, however many devices you have. Each device, and the recovery key, holds a wrap of the vault key in vault.json.
Per-device wraps of the vault key The iPad's key, the Mac's key and the recovery key on paper each hold a wrap of the vault key of the current epoch, stored in vault.json. The vault key gives the vault identity. Every file has its own file key, sealed in one stanza to the vault identity, whatever the number of devices. Adding a device adds one wrap and rewrites no file. Removing a device starts a new epoch with a new vault key; a record keeps the old key, so old files stay readable to the devices still listed. iPadits own key,never copied Macits own key,never copied Kit (R)recovery key,only on paper one wrap each Vault key of this epoch gives the vault identity Every file its own file key, in ONE stanza to the vault identity Add a device one more wrap; no file is rewritten Remove a device a new epoch and vault key for every new file;a record keeps the old key and lists the filesthat existed, so old notes stay readable
One vault key per epoch, wrapped once for each device and once for the recovery key.

What that means for you:

  • Adding a device is instant. It adds one wrap; no file is rewritten.
  • Removing a device is immediate. Everything written afterward, on any device that has seen the change, uses a new vault key that the removed device never gets. Old files stay as they are and stay readable to your other devices. A removed device notices, stops syncing, and offers to save what it had not synced.
  • Re-encrypt Everything is a separate, rare step that also replaces the recovery kit, for when even old files must stop opening with old keys.

The home device

The device that creates the vault is its home; the device list shows it as Manages devices. Only home changes the device list: it approves new devices, removes and renames them, replaces the recovery kit, and re-encrypts. Your other devices follow the list home signed.

The home device approves a new device A new iPhone asks to join the vault. The home device, the iPad that created the vault, approves it after you type, on the iPad, six words the iPhone shows (or scan its QR code); the iPhone then checks six words the iPad shows back. The home device signs the new device list. The Mac and every other device follow the list the home device signed; they never change it themselves. New iPhone asks to join six words typedor a QR code Home: the iPad approves, and signs the device list Mac follows the signedlist iPhone gets its wrap ofthe vault key
The home device approves new devices; the others follow its list.

To join, a new device asks, and shows six words (and a QR code). You type the words on the home device, or scan the code there, and approve. The home device then shows six words of its own, which you type on the new device. The words prove to each side that it is talking about the same request and the same vault, so a storage provider cannot slip in its own device or a vault of its own.

Handoff and takeover

Make Home. Home can hand its role to another of your devices, for example before you retire an old iPad. The vault gets a new key, as with any device change.

Takeover. If home is lost, stolen or broken, a device with your recovery key (the paper kit, or the passphrase copy) takes over. On the takeover screen you keep checked the devices you still have; the recovery key and the new home sign the new list together. A takeover wins over any change from the old home that it did not see, so a stolen home cannot undo it. A device that has no key for the vault at all can take over too: that is how you start again with nothing but the kit.

Handoff and takeover of the home role Handoff: the home iPad signs a handoff that names the Mac, which becomes home. Takeover: the iPad is lost. A device holding the recovery key, from the paper kit or the passphrase copy, signs a takeover together with the new home device. The takeover names the new home and the devices you keep checked on the takeover screen; it beats any later change from the old home that it did not see. Handoff iPad (home) signs a handoff Mac is home from now on Takeover The home iPad is lost or stolen. Recovery kit or the passphrase copy Mac the new home both sign Takeover names the new home and the devices you keep;beats changes from the old home it did not see
Make Home while home is at hand; a takeover with the recovery kit when it is not.

Every other device shows an alert after a takeover. If you did not do it, someone has your recovery kit: replace the kit, from the device that now manages devices, at once.

Files that arrive late

A device that was offline during a change keeps writing until it hears about it. Files it wrote under the old key are not lost: once it sees the change, it encrypts them again under the new key. Files under an old key that no device change accounts for, for example written by a removed device after its removal, are set aside: never read as notes and never deleted unless you say so. They are listed in Repair ▸ From Before a Device Change.

What to keep in mind

  • Managing devices needs the home device or the recovery key. To remove a device while home is out of reach, take over with the kit first.
  • A stolen home device acts as the owner until you take over. Do it promptly.
  • A takeover drops device-list changes from the old home that it had not seen: devices added there must be approved again (removals are covered, because you pick the list).
  • Whoever holds the recovery key holds everything. Someone who has the kit and your files can read the vault and take it over. Keep the kit as safe as the notes deserve.
  • Reading a note with stock age still works, with one extra age -d per epoch (Read your notes without Sempere).