A tar container
tar bundles files and folders into a single file. It is one of the oldest archive formats still in use, described by the POSIX standard.
The .obf format
An open archive, signed, encrypted when needed.
The .obf format combines public standards rather than a closed format: tar for the container, zstd for compression, AES-GCM for optional encryption, Ed25519 for the signature.
zstd compression
Zstandard (zstd) is a lossless compression algorithm, published as open source and described by RFC 8878. Lossless: once decompressed, each file is byte-for-byte identical to the original.
Optional AES-GCM encryption
AES-GCM is authenticated encryption: it makes the content unreadable without the key, and it detects any change to the encrypted content.
It is optional: an .obf archive can also stay unencrypted.
An Ed25519 signature
Ed25519 is a digital signature algorithm described by RFC 8032. The signature lets you check that an archive has not been modified since it was signed.
What an archive contains
An .obf archive is a folder named after the project and the revision. It holds the content file (the whole project folder, as tar.zst by default, or tar.gz, tar or zip, encrypted if requested), the manifest manifest.json and its signature signature.ed25519: this is Obscura Flow 2.0.8's format, unchanged. Vault adds a signed inventory annex (inventory.json and inventory.ed25519), which Flow ignores.
The manifest is the archive's readable inventory: identifier, project, revision, format, date, SHA-256 checksum of the content, and the list of every file with its path, size and SHA-256 checksum. The Ed25519 signature covers its exact bytes; since it includes the content's checksum, it protects the content too.
AES-256-GCM encryption works in 4 MiB blocks, each one authenticated. Only the content is encrypted: the manifest and the signature stay readable, so an encrypted archive can be verified without its key. Restoring it requires the encryption key.
- Without Obscura Vault, an unencrypted archive can be read with standard tools: the manifest in a text editor, checksums with shasum, the content with macOS's tar.
- Vault also reads, verifies and restores archives written by Obscura Flow.
Full and incremental revisions
Since version 1.2.0, every archive is a full revision (the default) or an incremental one. An incremental revision contains only the files added or changed since the previous revision, plus the signed inventory of the whole project, unchanged files included.
It is never restored alone, but with its whole chain: the latest full revision, then each incremental revision up to it. A chain holds at most ten incremental revisions; beyond that, or if the previous revision does not verify, Vault makes a full revision and says so.
Next step
Preserved originals, verified integrity.
Obscura Vault is available for macOS. Download it from your Obscura member area, or write to us to learn more.