Security

Basalt is built so that only devices you let in can reach your drive, and so that nothing of yours passes through anyone else’s servers.

In plain words

• Nobody joins without being let in. A new device needs the PIN the host shows, or, for the first device of a host with no screen, its setup code.
• Every connection is encrypted, on your own network as much as anywhere.
• Each device is sure of its host. It remembers the host it paired with, and refuses a different computer pretending to be it, even at the same address.
• Each device has a key of its own, kept in its security chip when it has one. It never leaves the device, so a copy of its settings can’t open your drive.
• There is no Basalt server and no account. Nothing is relayed through the internet, and Refora Technologies never sees your files or your library.
• Updates are only ever the official release, checked before they are installed.
• The source is public, under the GPLv3, for anyone to read.

The detail

Connections

Devices talk to the host over TLS 1.3, using rustls. When a device pairs, it records the host’s public key, and from then on accepts only that key, whatever address the host is at. The PIN or setup code is never sent as it is: inside the encrypted connection, the device proves it knows it, and the host checks the proof.

Device keys

When a device pairs, it makes a key pair of its own. The private key stays on the device: in the TPM on a Windows computer that has one, in the phone’s hardware key store on Android, and protected by the system otherwise. In the TPM and the phone’s key store, the key can be asked to sign, but can never be read out. The host keeps only the public key, and signing in means signing a fresh challenge, so there is no password to steal.

Devices paired before version 1.5 move to their own key by themselves the next time they connect to an updated host.

The host’s own secrets

The host’s private key is kept in its settings file. On Windows, it is sealed by Windows for that computer, so a copy of the file opens nowhere else. On Linux, the file can only be read by the user the host runs as.

Profiles

Profile PINs are stored on the host only as slow, salted hashes. Repeated wrong guesses lock a profile for longer each time, up to fifteen minutes. A profile from another drive never brings its PIN: the other host trusts a statement signed by the profile’s own drive instead.

Setup codes

A setup code is eight characters from an alphabet without look-alike letters, about 40 bits, behind the same slow check as a PIN. After ten wrong tries the host replaces it. It only works on your own network, and once it has been used, it is gone.

Managing a host

Every request from Manage host is checked by the host itself: the device must be signed in with its own key and be one the host lets manage it. No device can leave a host with nobody to manage it.

Updates

The host and the apps install only the newest release published on Basalt’s GitHub page, and only once its SHA-256 checksum matches the one published beside it. On Linux, host updates are installed by a small system helper that runs as root, takes no instructions from the host beyond “update now”, and finds and checks the release itself. The Docker image is signed, and carries a record of the GitHub workflow that built it.

Reporting a security problem

If you find a way around any of this, please tell us privately first, at reforatech@gmail.com, rather than in a public issue. We will reply, fix it, and credit you if you wish.