Features / Sealed files with levels

Working todayProved in Lean 4

Every file carries its level, and is sealed the moment it is saved.

Save a file into a level folder and ZENOS encrypts it, with its level written into a signed header. The keys belong to the system, not to the user, so a copied file opens nowhere else and for no one above their clearance.

AES-256-GCM

encryption, with the level in a signed header

RAM only

plaintext exists only in memory while the file is open

L1 to L5

five levels, from Basic to Specially Designated Secrets

How it works

Seal, open, guard

1

Seal

Saving into a level folder (Basic, Green, Red, Black) encrypts the file through the key agent, a service that runs as root.

  • The user never holds the level keys
  • Every seal and unseal is recorded in the ledger
2

Open

The key agent hands out plaintext only up to the user's clearance, or for one exact file with a grant that officers signed.

  • Office files are edited from a copy in memory
  • They are saved back sealed
3

Guard

From L3 up, copying out of the apps and screen capture are refused while the file is on screen.

  • A level clipboard pastes L4 only into L4 and above
  • Printing above the policy line is refused

The levels

What each level asks for

L1 Basic: everyday filesNo approval
L2 and L3 Green: copy out and capture are refused from L31 officer above clearance
L4 Red: new outbound connections are cut while it is open2 officers above clearance
L5 Black: Specially Designated Secrets, never printed3 officers above clearance

Proven, and what is not

The opening decision is mathematics

Proved in Lean 4

Checked on every build

  • A file's plaintext is handed out only within clearance or with a valid grant for that exact file
  • No file is opened while the PC is stopped, over any sequence of events
  • Content of a level reaches only places of that level or higher
  • A copy moved hop by hop never loses its level
Trusted, not proved

Tested and listed openly

  • The cryptography: AES-GCM and Ed25519
  • The keys are root-owned files, not yet sealed in a TPM
  • Other programs could still write copies, until mandatory access control (SELinux) is added
  • A camera pointed at the screen

Try it in the preview

Try it yourself

1

Save into Red · L4

Drag any file into the Red folder on the desktop. It becomes a sealed .zen file.

2

Open it below clearance

From an account cleared to L2, open it. A request goes to the officers.

3

Approve on two phones

Each officer approves in ZENOS Messages. Exactly that file opens.

Download the previewRead the proofsRead the sourceThreat model
← All featuresNext: Approval to open →