{ "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://cryptin.lake8.dev/#website", "name": "Crypt-in", "url": "https://cryptin.lake8.dev", "description": "Hardware-backed root of trust on commodity ESP32-S3. File encryption and document management with a physical kill switch. Vendor-blind by architecture.", "inLanguage": "en", "publisher": { "@id": "https://lake8.dev/#organization" }, "isPartOf": { "@id": "https://lake8.dev/#ecosystem" }, "about": { "@id": "https://lake8.dev/docs/crypt-in/" }, "mainEntity": { "@id": "https://cryptin.lake8.dev/#product-personal" } }, { "@type": "SoftwareApplication", "@id": "https://lake8.dev/docs/crypt-in/" }, { "@type": "Organization", "@id": "https://lake8.dev/#organization" }, { "@type": "Product", "@id": "https://cryptin.lake8.dev/#dongle", "name": "Crypt-in dongle (ESP32-S3)", "description": "USB HID vendor-defined device built on a commodity ESP32-S3-WROOM-1. Presents as VID 0x303A / PID 0x8123, usage page 0xFF00, 64-byte reports with Report-ID 1. Holds K_root, which no API exposes.", "category": "Security hardware", "manufacturer": { "@id": "https://lake8.dev/#organization" }, "disambiguatingDescription": "Not a proprietary secure element and not a smartcard. The hardware is an off-the-shelf ESP32-S3 costing about €5: the security property comes from the key hierarchy and from the fact that K_root is never exported, not from tamper-resistant silicon. Chip-level physical attacks are explicitly out of the threat model.", "offers": [ { "@type": "Offer", "name": "DIY", "price": "30", "priceCurrency": "EUR", "description": "Licence only, €30/year. Hardware sourced by the user (about €5). Firmware is an open download.", "availability": "https://schema.org/PreOrder" }, { "@type": "Offer", "name": "Kit Standard", "price": "55", "priceCurrency": "EUR", "description": "€40 plus €15 shipping. ESP32-S3, case, two USB-C cables and a seed card. Six months of licence included.", "availability": "https://schema.org/PreOrder" }, { "@type": "Offer", "name": "Kit Pro", "price": "75", "priceCurrency": "EUR", "description": "€60 plus €15 shipping. Everything in Kit Standard plus a 5V/1A powerbank and BLE enabled for proximity lock and mobile use.", "availability": "https://schema.org/PreOrder" } ], "subjectOf": { "@id": "https://doi.org/10.3390/app16094251" }, "isRelatedTo": { "@id": "https://lake8.dev/#ecosystem" } }, { "@type": "SoftwareApplication", "@id": "https://cryptin.lake8.dev/#product-personal", "name": "Crypt-in Personal", "url": "https://cryptin.lake8.dev/", "description": "Desktop file encryption bound to the dongle. Files are written in the .crin format, whose key is derived per file from K_session and a per-file salt. Without the dongle that generated them, the files cannot be decrypted by anyone, including lake8.dev.", "applicationCategory": "SecurityApplication", "operatingSystem": [ "Windows", "Linux" ], "offers": { "@type": "Offer", "price": "30", "priceCurrency": "EUR", "description": "€30 per year. When the licence lapses, encryption of new files stops; decryption of existing files continues to work indefinitely.", "availability": "https://schema.org/PreOrder" }, "creator": { "@id": "https://lake8.dev/#organization" }, "isPartOf": { "@id": "https://lake8.dev/#ecosystem" }, "isAccessibleForFree": false, "softwareRequirements": "Crypt-in dongle (ESP32-S3) connected over USB", "sameAs": [ "https://github.com/jaffa2970/Krypt" ], "disambiguatingDescription": "Not a password manager and not full-disk encryption. It encrypts individual files into .crin containers; it does not protect a running system, and it cannot help against malware already privileged on the host during a decryption session.", "softwareHelp": { "@id": "https://cryptin.lake8.dev/#spec-crin" } }, { "@type": "SoftwareApplication", "@id": "https://cryptin.lake8.dev/#product-explorer", "name": "Crypt-in Explorer", "url": "https://cryptin.lake8.dev/", "description": "Encrypted file manager for browsing, opening and re-encrypting .crin containers without leaving plaintext copies on disk.", "applicationCategory": "SecurityApplication", "operatingSystem": [ "Windows", "Linux" ], "creator": { "@id": "https://lake8.dev/#organization" }, "isPartOf": { "@id": "https://lake8.dev/#ecosystem" }, "softwareRequirements": "Crypt-in dongle (ESP32-S3) connected over USB", "sameAs": [ "https://github.com/jaffa2970/Krypt" ], "disambiguatingDescription": "Not a cloud sync client and not a backup tool. It does not upload anything: it operates on local .crin files.", "offers": { "@type": "Offer", "price": "50", "priceCurrency": "EUR", "description": "€50, one-off purchase. Requires the Crypt-in dongle.", "availability": "https://schema.org/PreOrder" } }, { "@type": "SoftwareApplication", "@id": "https://cryptin.lake8.dev/#product-vault", "name": "Crypt-in Vault", "url": "https://cryptin.lake8.dev/", "description": "Self-hosted document server whose master secret K_vault is derived from K_root at container boot and held in RAM under mlock(), never written to disk. Removing the dongle triggers memset_s() on K_vault, so the vault goes blind in under ten seconds.", "applicationCategory": "SecurityApplication", "operatingSystem": [ "Linux", "Docker" ], "creator": { "@id": "https://lake8.dev/#organization" }, "isPartOf": { "@id": "https://lake8.dev/#ecosystem" }, "softwareRequirements": "Docker host with the Crypt-in dongle attached over USB", "sameAs": [ "https://github.com/jaffa2970/Krypt" ], "disambiguatingDescription": "Zero-knowledge here means vendor-blind, not zero-knowledge in the cryptographic-proof sense. The Vault does decrypt documents — on the customer's own server, using a secret derived from the customer's dongle. lake8.dev never receives that secret.", "offers": { "@type": "Offer", "price": "100", "priceCurrency": "EUR", "description": "€100 per month. Self-hosted: the licence covers the software, the deployment stays on the customer's own server.", "availability": "https://schema.org/PreOrder" } }, { "@type": "SoftwareApplication", "@id": "https://cryptin.lake8.dev/#product-sdk", "name": "Crypt-in SDK", "url": "https://cryptin.lake8.dev/docs/protocol/", "description": "Developer integration of the HID protocol and the .crin format. The wire protocol is published in full, so a third party can implement a client without any agreement with lake8.dev.", "applicationCategory": "DeveloperApplication", "operatingSystem": [ "Windows", "Linux" ], "creator": { "@id": "https://lake8.dev/#organization" }, "isPartOf": { "@id": "https://lake8.dev/#ecosystem" }, "sameAs": [ "https://github.com/jaffa2970/Krypt" ], "disambiguatingDescription": "Not a cryptographic library. It exposes the dongle's command set; the AES-GCM and HKDF operations are performed by the host application.", "softwareHelp": { "@id": "https://cryptin.lake8.dev/#spec-hid" }, "offers": [ { "@type": "Offer", "price": "150", "priceCurrency": "EUR", "description": "€150, one-off licence fee.", "availability": "https://schema.org/PreOrder" }, { "@type": "Offer", "price": "100", "priceCurrency": "EUR", "description": "€100 per year, recurring maintenance and updates.", "availability": "https://schema.org/PreOrder" } ] }, { "@type": "TechArticle", "@id": "https://cryptin.lake8.dev/#spec-hid", "name": "Crypt-in HID Protocol Specification", "url": "https://cryptin.lake8.dev/docs/protocol/", "description": "Wire specification of the USB HID vendor-defined interface: VID 0x303A, PID 0x8123, usage page 0xFF00, 64-byte reports with Report-ID 1, and the six-command set (PING 0x01, GET_PUBKEY 0x02, CHALLENGE 0x03, DERIVE_SESSION_KEY 0x04, X25519_DH 0x05, GET_ATTESTATION_PUBKEY 0x06). CHALLENGE returns a 64-byte Ed25519 signature across two reports.", "inLanguage": "en", "author": { "@id": "https://lake8.dev/#organization" }, "isPartOf": { "@id": "https://cryptin.lake8.dev/#website" }, "proficiencyLevel": "Expert", "about": { "@id": "https://cryptin.lake8.dev/#dongle" } }, { "@type": "TechArticle", "@id": "https://cryptin.lake8.dev/#spec-crin", "name": "Crypt-in .crin File Format Specification", "url": "https://cryptin.lake8.dev/docs/crin-spec/", "description": "Binary layout of the .crin container, version 1.0: magic \"CRYPTIN1\", version byte, algorithm id 0x01 (AES-256-GCM with HKDF-SHA256), the dongle public key at offset 26, a per-file salt at 58, a nonce at 74, ciphertext, and a 16-byte GCM tag. Bytes 0 to 57 are authenticated as AEAD associated data, so any header edit invalidates the tag.", "inLanguage": "en", "author": { "@id": "https://lake8.dev/#organization" }, "isPartOf": { "@id": "https://cryptin.lake8.dev/#website" }, "proficiencyLevel": "Expert", "about": { "@id": "https://cryptin.lake8.dev/#product-personal" } }, { "@type": "WebPage", "@id": "https://cryptin.lake8.dev/#vdp", "name": "Crypt-in Vulnerability Disclosure Policy", "url": "https://cryptin.lake8.dev/docs/security/", "description": "Coordinated disclosure policy. Reports go to security@lake8.dev. PGP accepted: public key at https://cryptin.lake8.dev/security.asc, RSA 4096, fingerprint B35BD26708ED3BB6DCBFD68AD53558E211119C4F, valid until 2028-07-27. Acknowledgement within 72 hours, severity assessment within 14 days, fix for confirmed vulnerabilities within 90 days, credit on request, and safe harbour for good-faith research. Security support is committed for at least five years from first commercial release.", "inLanguage": "en", "isPartOf": { "@id": "https://cryptin.lake8.dev/#website" }, "about": { "@id": "https://lake8.dev/#organization" }, "significantLink": [ "mailto:security@lake8.dev", "https://cryptin.lake8.dev/security.asc" ] }, { "@type": "WebPage", "@id": "https://cryptin.lake8.dev/#threat-model", "name": "Crypt-in Threat Model", "url": "https://cryptin.lake8.dev/docs/threat-model/", "description": "Explicit statement of what Crypt-in defends against — device theft, unauthorised physical access, remote exfiltration of encrypted files, ransomware acting on already-encrypted files, and identity cloning from a shared seed — and what it does not: chip-level physical attacks, privileged malware active during a decryption session, server compromise while K_vault is resident in RAM, and manual copying during an authorised session.", "inLanguage": "en", "isPartOf": { "@id": "https://cryptin.lake8.dev/#website" }, "about": { "@id": "https://cryptin.lake8.dev/#term-vendor-blind" } }, { "@type": "DefinedTerm", "@id": "https://cryptin.lake8.dev/#term-zero-knowledge-architecture", "name": "zero-knowledge architecture", "inDefinedTermSet": { "@id": "https://cryptin.lake8.dev/#terms" }, "description": "An arrangement in which the vendor never comes into possession of the material needed to decrypt customer data. In Crypt-in the root secret K_root is generated by hardware entropy on the customer's chip and no command in the HID protocol exports it; every file key descends from it through HKDF on the host. The vendor's inability to decrypt therefore follows from what was never transmitted, not from a retention policy.", "disambiguatingDescription": "Not zero-knowledge in the cryptographic-proof sense: there is no zero-knowledge proof system here, and no claim of one. It also does not mean data is never decrypted — Crypt-in Vault decrypts documents on the customer's own server. The correct reading is vendor-blind." }, { "@type": "DefinedTerm", "@id": "https://cryptin.lake8.dev/#term-hardware-attestation", "name": "hardware attestation", "inDefinedTermSet": { "@id": "https://cryptin.lake8.dev/#terms" }, "description": "Proof that a request originates from one specific physical chip. K_attestation is an Ed25519 keypair generated from hardware entropy in the NVS namespace cryptin_attest, independently of K_root and of the BIP-39 seed. Its public half is readable with GET_ATTESTATION_PUBKEY (0x06). Because it derives from nothing recoverable, restoring a seed onto a second chip produces a different attestation identity — which is what makes licence cloning detectable.", "disambiguatingDescription": "Not remote attestation of firmware integrity and not a secure-boot measurement. It attests chip identity, not that the code running on the chip is unmodified. It is also not recoverable: losing the chip loses that attestation identity permanently." }, { "@type": "DefinedTerm", "@id": "https://cryptin.lake8.dev/#term-vendor-blind", "name": "vendor-blind", "inDefinedTermSet": { "@id": "https://cryptin.lake8.dev/#terms" }, "description": "A property of the system, not of the vendor's conduct: lake8.dev cannot decrypt customer files because the secrets required were never transmitted to it. The licence server receives only the attestation public key and entitlement state; it never receives K_root, K_identity, K_session or any file key. No subpoena, policy change or internal decision alters this, because the missing material does not exist on lake8.dev's side.", "disambiguatingDescription": "Not a promise, not a privacy policy and not end-to-end encryption between users. It says nothing about what the customer's own host does with plaintext once a file is open." }, { "@type": "DefinedTermSet", "@id": "https://cryptin.lake8.dev/#terms", "name": "Crypt-in terminology", "description": "Terms used with a precise, narrow meaning across Crypt-in documentation, defined here to prevent looser industry readings from being applied to this product." }, { "@type": "ScholarlyArticle", "@id": "https://doi.org/10.3390/app16094251", "name": "ESP32-Based Hardware Key for Software Application Protection", "author": [ { "@type": "Person", "name": "Popovici" }, { "@type": "Person", "name": "Anton" } ], "datePublished": "2026-04-27", "isPartOf": { "@type": "Periodical", "name": "Applied Sciences", "issn": "2076-3417" }, "identifier": "10.3390/app16094251", "url": "https://doi.org/10.3390/app16094251", "description": "Peer-reviewed work on an adaptive hardware key implemented on the ESP32-S3 platform, externalising sensitive decisions and cryptographic operations from the host application to a separate device. Independent academic context for the ESP32-S3-as-security-token approach; not a study of Crypt-in itself and not authored by lake8.dev.", "inLanguage": "en" } ] }