TLDR Tech / InfoSec
VaultSort V4: Hardware-Bound File Encryption and Touch ID
VaultSort V4 makes file encryption hardware-bound on macOS and adds Touch ID as a first-class key, running fingerprint encryption through the same Secure Enclave-backed path as a YubiKey. The V4 chain derives a per-file wrap key from a hardware PRF output through HKDF-SHA-256, seals a random 256-bit file key with AES-256-KWP, and encrypts the body with AES-256-GCM under an authenticated header, which closes a V3 gap where the YubiKey touch was an application-layer gate, and the file key could be derived offline from VaultSort's on-disk credential store. Touch ID requires macOS 14 Sonoma or later, and since this is a vendor self-disclosure for a closed-source $24.99 product, the byte-level guarantees rest on VaultSort's own free Security Design Document rather than independent review.
Read the full story