Ledger Key
ClipLedger creates 256 random bits on first launch. The key is stored in iCloud Keychain as synchronizable and only available while your device is unlocked.
Ledger Key
├── HKDF · db + device salt → SQLCipher
├── HKDF · blob → AES-256-GCM
└── HKDF · cloud → AES-256-GCM + private CloudKit
├── HKDF · db + device salt → SQLCipher
├── HKDF · blob → AES-256-GCM
└── HKDF · cloud → AES-256-GCM + private CloudKit
Three derived keys
A device salt and HKDF create the SQLCipher database key.
HKDF creates an AES-256-GCM key for larger files, each with a unique nonce.
HKDF creates a separate AES-256-GCM key for CloudKit payloads.
Recovery
A verified 24-word recovery phrase can move the Ledger Key without iCloud Keychain. The phrase is never stored. Without the key or phrase, nobody can recover the ledger, including us.