How ScanLocker protects what you keep in it
ScanLocker encrypts every picture and every Locker item with AES-256-GCM under 256-bit keys held in the Keychain of this iPhone.
How a Locker item is stored
Tapping Save encrypts a Locker item into its own Keychain item, restricted to this iPhone and never synchronised. The key is the Locker tab’s key, or the tab’s Vault key for a Vault item such as a crypto seed phrase. Each is made on this iPhone and wrapped by the Secure Enclave.
How a picture is stored
Pictures, thumbnails and the folder catalog are encrypted files under iOS complete file protection, and they stay out of the backup iOS makes of the iPhone. The Scan tab’s key is a Keychain item restricted to this iPhone and never synchronised. Vault pictures use the tab’s Vault key, which the Secure Enclave wraps.
The iCloud backup and its keys
Turning Automatic Backup on puts a copy of each tab’s key in iCloud Keychain, so the backup opens on an iPhone signed in to the same Apple Account. Neither Vault key is copied, so Vault has no copy in iCloud and no recovery.
The PIN
ScanLocker has one PIN, over the Scan tab, the Locker tab or both, set only while Face ID or a passcode is on. It is stored in the Keychain as a PBKDF2-HMAC-SHA256 hash over a random salt at 120,000 iterations.
After nine wrong entries the keypad waits 30 seconds, and the wait doubles with each further one, up to an hour. After 18 it takes no entry until this iPhone is unlocked with Face ID or its passcode.
A PIN cannot be recovered. Forgot your PIN? appears wherever the PIN is asked for, and typing DELETE ALL there erases what the PIN covers, Vault included.
The network
ScanLocker has no account and no server of ours. The connections the application opens
Screenshots and screen recordings
Allow Screenshots and Allow Screen Recordings, under Allow Screen Capture on the Settings tab, both start at No. At No, a capture of an open picture comes out black, a cover hides the Locker form and a revealed secret during a recording, and the capture is counted on the Security page and marks the item on screen red.
At Yes, a capture outside Vault shows the screen and is not noted. With Vault open, a Vault picture stays black and a capture is counted and marked at either setting.
Where a PDF is read
Tapping Import and then Documents hands the chosen PDF to a separate process that holds no key, and each page returns as one picture.
The pasteboard
Every Locker form refuses Cut and Copy, and a revealed secret cannot be selected. The Note and Key / Value forms outside Vault offer Paste, which marks the item as imported.
The eight checks on the Security page
Security Audit on the Settings tab opens the Security page.
| Check | What it reads |
|---|---|
| Vault exposed to device backups | The backup exclusion on the stored files |
| Unexpected internet connection | Web requests ScanLocker makes to an Internet host |
| Modified iOS detected | Files a modified iOS leaves, and encrypted data that will not open |
| Screenshot detected | Screenshots at No, or with Vault open |
| Screen recording detected | Recordings at No, or with Vault open |
| Secret copied to clipboard | Any secret that reached the clipboard |
| Unpaired device tried to connect | Each refusal since the last Reset History |
| Vault item will not open | Each Vault item on both tabs |
The cryptography in use
Every algorithm is a published standard, and the application implements no cipher, hash, key derivation function or key agreement of its own design.
| Algorithm | Used for | Supplied by |
|---|---|---|
| AES-256-GCM | Every picture and Locker item, the transfer payload and the iCloud backup | Apple CryptoKit |
| ChaCha20-Poly1305 | The outer channel of an Internet transfer | Apple CryptoKit |
| Curve25519 key agreement | Each paired iPhone’s key pair, and half of the secret behind each transfer’s key | Apple CryptoKit |
| ML-KEM-768 | The other half of that secret | Apple CryptoKit |
| CPace over Curve25519 | Authenticating the pairing PIN or code, mapped to a curve point by Elligator 2 of RFC 9380 | The application, from the published specification, calling Apple CryptoKit |
| P-256 key agreement in the Secure Enclave | Wrapping the Locker key and the two Vault keys | Apple CryptoKit and the Secure Enclave |
| HKDF over SHA-256 | Deriving each transfer, envelope and pairing key | Apple CryptoKit |
| HMAC over SHA-256 | Authenticating the transfer handshake | Apple CryptoKit |
| SHA-256 and SHA-512 | Deriving and comparing values, with SHA-512 in the pairing exchange | Apple CryptoKit |
| PBKDF2 | Hashing the PIN | Apple CommonCrypto |
| iOS Data Protection | Keeping the encrypted files unreadable while the iPhone is locked | iOS |
| iCloud Keychain | Carrying a tab’s key copy to an iPhone on the same Apple Account | iOS |
Reporting a vulnerability
Write to security@zirkon.services with the iPhone model, the iOS version and the steps that reproduce the finding. The same contact is at /.well-known/security.txt.