cryptbox
cryptbox is an operating system based on NixOS. It changes a standard computer into a storage device for passwords, keys and files. The device connects to your local network. It has no route to the internet.
Design specification
| Base system | NixOS 26.05 |
|---|---|
| Hardware | x86-64 or ARM64 computer with UEFI and 4 GB of RAM or more |
| TPM | TPM 2.0 is recommended. Without a TPM, the device cannot prove that its system has no changes. |
| Network | Ethernet or Wi-Fi. The device accepts TCP port 443 from private addresses only. It ignores the DHCP gateway. |
| System | Read-only. dm-verity checks each block when the device reads it. |
| Storage | ZFS mirror across all NVMe and SATA drives |
| Encryption | Each secret is one age file with hybrid post-quantum keys. Standard age tools can decrypt the data. |
| Keys | Keys stay in RAM while the device is unlocked. A restart locks the device. |
| Files | No size limit. Available disk space is the only limit. |
| Backup | Encrypted copies on a USB drive. You can restore a backup on different hardware. |
| Interfaces | Web interface on the local network. Text interface on the screen of the device. |
Limits
- The device has no secure element and no tamper detection.
- An attacker with kernel access can change the firewall until the next restart. Block the device at your router.
- Do not forward a router port to the device.
- If you lose the passphrase and the recovery key, you cannot recover the data.