Keys and security

Vault uses three kinds of keys. They are kept in your Mac’s keychain, not in the library: a database backup does not contain them. If you lose this Mac without having exported them, you lose them.

To these are added the access keys of your offsite destinations, also kept in the keychain (see Offsite copies), and the session of your licence account.

What happens if a key is lost

• Archive signing key: it only signs, and opens no archive. Your archives are not damaged, but on another Mac that does not know this key they are unverifiable and refused at restore; and nobody can sign with the same key any more. Keep a copy of this key (or at least of its public key) so that it can be recognised as a trusted key on another Mac.
• Archive encryption key: an encrypted archive can no longer be opened, by anyone. There is no way to recover it without the key.
• Certificate key: you can no longer issue under this identity. Certificates already issued stay verifiable, since verifying needs only the public key (the one in the file you publish); but you no longer hold the key that signed them. That is why issuance is blocked until a backup has been exported.

Vault never creates a new key in place of a key it cannot read in the keychain (locked keychain, access refused, damaged item): it stops and says so (“No new key was created”, so as not to make your archives unverifiable; for certificates, the settings show that the key could not be read and issuance is blocked). A new key is only created when there is genuinely none.

Back up the archive keys

1. In Archives, click Archive Keys….
2. The This Installation section shows the fingerprint of the Signature key and whether the Encryption key is present.
3. Click Export the Encryption Key… or Export the Signing Key…, enter a passphrase of at least 12 characters, confirm it, then Export… (suggested files: obscura-vault-chiffrement.key, obscura-vault-signature.key).
4. To verify your archives on another Mac, the public key is enough: Export Public Key…. That file is not secret.

As long as a key of this installation was never exported, the Archives screen, the Archive Keys sheet and the dashboard recall it, one line per key, with Back Up Keys…:

• the encryption key, as soon as it exists (with the first encrypted archive), comes first and in red, as it is the more serious: “Without it, your encrypted archives cannot be opened on any other Mac, by anyone.”;
• the signing key only signs: “Without an export, another Mac will see your archives as “unverifiable”, and you will no longer be able to sign with the same key.”

The sheet shows for each key the date of its last export.

The exported file is encrypted with the passphrase and readable by you alone on this Mac (permissions 0600). Store the file and the passphrase apart, off this Mac, and never next to the archives they protect: together, they open your encrypted archives or sign in your name.

In Clear for Obscura Flow… writes the key without a passphrase, in the format Obscura Flow can import, after a confirmation. Anyone who reads that file holds the key: delete it as soon as Flow has imported it. Obscura Flow’s old backups in clear still import into Vault.

Back up the certificate key

In Certificates › Settings…, Signing Key section: enter a passphrase of at least 12 characters, confirm it, then Export a Backup…. This file is encrypted with the passphrase. Store the file and the passphrase separately: together, they allow issuing in your name.

The file starts with a few readable lines that state the key’s fingerprint; the rest is encrypted.

Reinstall the certificate key (new Mac)

1. In Certificates › Settings…, Signing Key section, click Import a Key Backup… and choose the backup file.
2. Vault shows the fingerprint of the key it holds: check that it is your certificates’ (it is printed on each one, “full key fingerprint”).
3. Enter the Backup passphrase, then Restore Key.

The key becomes this Mac’s signing key again, with the same fingerprint: the certificates it signed are attributed to it again and verify here as “key recognised”. The backup you just opened counts as a confirmed backup.

Vault refuses:

• a wrong passphrase, or a file that is not a certificate key backup;
• a key this library retired or declared compromised: it will not sign again;
• to replace a current key that signed certificates and was never backed up: export a backup of it first, or it would be lost. A different current key that was backed up is retired (it stays published);
• to write anything if the current key could not be read from the keychain.

Then export the public key file over the one you already publish (see Preservation certificates): the keys it held stay in it.

To retire a certificate key or declare it compromised (stolen Mac, disclosed backup), see Preservation certificates › Retire the signing key or declare it compromised.

Verify and restore Obscura Flow archives

Vault verifies a signature with this installation’s key and with its trusted signing keys. To verify and restore archives created by Obscura Flow, import Flow’s keys once:

1. In Obscura Flow, open the settings, Archive tab, Encryption section, and export:
   • the signing key with Sauvegarder la clé de signature… (Back Up Signing Key…);
   • if your Flow archives are encrypted, the encryption key with Sauvegarder la clé… (Back Up Key…).
2. In Vault, open Archives › Archive Keys….
3. Click Import Signing Key… and choose the signing key backup. Vault keeps only its public part: it will be able to verify Flow’s signatures, not sign in its name. The key appears under Trusted Signing Keys (“Trusted key added”).
4. If needed, click Import Encryption Key… and choose Flow’s encryption key backup. It is added to the keys tried to open an encrypted archive; it never replaces Vault’s encryption key.

The signing key import button also accepts a Vault signing key backup (from another installation) or an Ed25519 public key.

These keys are used wherever Vault verifies or restores an archive: the Archives screen, restoring from Offsite.

To stop trusting an imported key, click Remove… on its line and confirm. The archives it signed become not verifiable again; you can import the key again later. This installation’s signing key cannot be removed. The removal is recorded in the journal.

Restore your archives on a new Mac

1. Install Vault on the new Mac.
2. In Archives › Archive Keys…, import your signing key backup with Import Signing Key… (the button accepts a Vault backup, and then asks for its passphrase): your old archives become verifiable again.
3. Import your encryption key backup with Import Encryption Key…: your old encrypted archives become restorable again.
4. Verify and restore your archives (Verify…, Restore…, or from Offsite).

The new Mac will create its own signing key with its first archive.

Good practice

• Export the keys as soon as they are created: after your first archive, your first encrypted archive, the creation of the certificate key.
• Keep at least two copies of the key files, in two places, and none in the same folder as the archives or their offsite copy.
• Never send a key file by e-mail.
• Test a restore from time to time, into another folder, to make sure you have the right keys.