vaultseal 0.3.0

Seal vault items under a vault key with AES-256-GCM and wrap that key with X25519 or ML-KEM-768.

VaultSeal

VaultSeal seals vault items under a vault key and wraps that key to members. The server stores ciphertext only.

This is the Dart package. The PyPI project named vaultseal is a different tool.

Scheme 1 wire format is stable since 0.1.0. Scheme 2 adds a hybrid wrap and does not change item bytes. The Dart API can still change before 1.0.0.

Install

dependencies:
  vaultseal: ^0.3.0

import 'package:vaultseal/vaultseal.dart';

Example

example/main.dart seals one item and wraps the vault key to one member:

final key = await VaultKey.generate();
final member = await MemberKeyPair.generate();
final item = SealContext(vaultId: 'vault-1', itemId: 'item-1');
final sealed = await sealItem(
  plaintext: Uint8List.fromList(utf8.encode('hello vault')),
  vaultKey: key,
  context: item,
);
final opened = await openItem(sealed: sealed, vaultKey: key, context: item);

What scheme 1 does

• Item encryption is AES-256-GCM. The 32-byte vault key is the AES key.
• Vault-key wrap is HPKE Base, single-shot: DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-256-GCM (RFC 9180).
• Associated data binds vaultId, itemId, and purpose for items, and vaultId, keyGeneration, and the recipient public key for wraps.

Byte layout, limits, and error behavior are in SPEC.md.

Also in 0.3.0

• rotateVaultKey opens the listed items, seals them under a new vault key, and wraps that key to the remaining members. The app stores the new blobs and drops the previous generation.
• wrapHybridVaultKey wraps a vault key with ML-KEM-768 and X25519 (KeyAgreementScheme.hybridMlKem768). Items stay AES-256-GCM.
• sealSharePayload seals an ephemeral share under a 32-byte DEK. The PIN stays in the app.

Limits the app must honor

• Rotate a vault key before 2^32 seals. Nonces are random and this library does not count them.
• Plaintext longer than 8 MiB is rejected.
• Scheme 1 and scheme 2 wraps do not authenticate the sender. Bind each wrap to an authenticated membership record before trusting it. See THREAT_MODEL.md.
• destroy() zeroes the copy this library holds. That wipe is best-effort on the Dart VM.

Report vulnerabilities through SECURITY.md. Do not open a public issue that contains key material.